@camstack/system 1.2.419 → 1.2.421

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -1,5 +1,7 @@
 import type { Server as NetServer, Socket as NetSocket } from "node:net";
 import { type MeshCrl } from "./mesh-crl.js";
+/** Field of the gossip HELLO payload carrying the sender's mesh-TLS listen port. */
+export declare const MESH_TLS_PORT_HELLO_FIELD = "meshTlsPort";
 type TcpTransporterConstructor = new (opts?: Record<string, unknown>) => TlsTcpTransporterBase;
 declare const TcpTransporterBase: TcpTransporterConstructor;
 interface TlsTcpTransporterBase {
@@ -34,6 +36,13 @@ interface TlsTcpTransporterBase {
 	registry: {
 		regenerateLocalRawInfo(force: boolean): void;
 	};
+	broker: {
+		serializer: {
+			serialize(payload: unknown, type: string): Buffer;
+			deserialize(buf: Buffer, type: string): unknown;
+		};
+	};
+	nodeID: string;
 	startTcpServer(): Promise<number>;
 	startUdpServer(): Promise<void>;
 	startTimers(): void;
@@ -43,6 +52,7 @@ interface TlsTcpTransporterBase {
 	disconnect(): Promise<void>;
 	onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
 	receive(cmd: string, data: Buffer, socket?: NetSocket): unknown;
+	publish(packet: OutgoingPacket): Promise<unknown>;
 	deserialize(type: string, data: Buffer): {
 		payload: {
 			sender?: string;
@@ -71,7 +81,38 @@ export interface TlsTcpTransporterOptions {
 	readonly crl?: MeshCrl;
 	/** Hub only (D826): never bind clear TCP or UDP discovery. */
 	readonly hubTlsOnly?: boolean;
+	/**
+	* Enrolled agent only (D848): the hub is the only mesh peer — no clear
+	* reader, TLS accepted from the hub's certificate only, nothing dialled but
+	* the hub, other nodes in the hub's gossip ignored.
+	*/
+	readonly hubOnlyPeers?: boolean;
+	/** The hub's node id (default `hub`). */
+	readonly hubNodeId?: string;
+	/**
+	* Port to dial a TLS peer on when it advertises none (default: `tlsPort`).
+	* An agent sets the hub's TLS port here; its own listener stays on `tlsPort`.
+	*/
+	readonly peerTlsPort?: number;
+}
+/** A packet on its way out (Moleculer `Packet`). */
+interface OutgoingPacket {
+	readonly type: string;
+	readonly target: string | null;
+	readonly payload: Record<string, unknown>;
+}
+/** The mesh-TLS port a gossip HELLO payload advertises, or null. */
+export declare function helloMeshTlsPort(payload: unknown): number | null;
+/** A gossip payload with only the kept nodes, and the ids that were removed. */
+export interface FilteredGossip {
+	readonly payload: unknown;
+	readonly removed: readonly string[];
 }
+/**
+* A gossip response with every node but `keep` removed. With nothing to
+* remove the payload is returned unchanged.
+*/
+export declare function keepOnlyGossipNodes(payload: unknown, keep: ReadonlySet<string>): FilteredGossip;
 export declare class TlsTcpTransporter extends TcpTransporterBase {
 	private tlsServer;
 	private meshTls;
@@ -81,19 +122,29 @@ export declare class TlsTcpTransporter extends TcpTransporterBase {
 	private readonly tlsPeers;
 	private clearDisabled;
 	private readonly hubTlsOnly;
+	private readonly hubOnlyPeers;
+	private readonly hubNodeId;
+	private readonly peerTlsPortOption;
+	/** Peers already reported as not adopted (D848) — one line each. */
+	private readonly ignoredPeers;
+	/** Node id → the mesh-TLS port its last HELLO advertised. */
+	private readonly helloTlsPorts;
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	private clearWriterConnect;
 	private writerTlsPatched;
 	constructor(opts?: TlsTcpTransporterOptions);
+	/** Clear TCP is never served: the TLS-only hub, or an agent whose only peer is the hub. */
+	private get tlsOnly();
 	override startTcpServer(): Promise<number>;
 	override connect(): Promise<void>;
 	/**
-	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
-	* handshake), or when dialling the hub node id (agent → hub). Everyone else
-	* (runners, unenrolled agents) stays on the clear writer — the hub must not
-	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	* Outbound dial uses mTLS when dialling the hub node id (agent → hub), on a
+	* TLS-only hub (it has no clear listener, so no clear peer exists to dial —
+	* D848 closes the hub → agent clear leg), or when the peer is already known
+	* on TLS (inbound handshake).
 	*/
 	private shouldDialPeerWithTls;
+	/** The peer's advertised mesh-TLS port, else the configured dial port, else 6443. */
 	private peerTlsDialPort;
 	/**
 	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
@@ -135,6 +186,16 @@ export declare class TlsTcpTransporter extends TcpTransporterBase {
 	/** Close sockets whose peer serial was just revoked. */
 	dropRevokedSockets(): void;
 	override disconnect(): Promise<void>;
+	/**
+	* D848: an enrolled agent adopts no node from the hub's gossip but the hub
+	* itself, so it never learns — and therefore never dials or broadcasts to —
+	* another agent. Everything else is Moleculer's own handling.
+	*/
+	override receive(cmd: string, data: Buffer, socket?: NetSocket): unknown;
+	/** Remember the TLS port a peer's HELLO advertises (absent: an older node → the default). */
+	private noteHelloTlsPort;
+	/** A TLS-listening node says where in every HELLO it sends. */
+	override publish(packet: OutgoingPacket): Promise<unknown>;
 	override onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
 	private startTlsServerIfReady;
 	private onTlsClientConnected;

package/dist/{restore-archive-gGHgAZsz.mjs → restore-archive-BUMSox6L.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-C0wYvAHC.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-0OD9ue39.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-DZeFVS2l.js → restore-archive-W1Cg5y6C.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DLHPmdoV.js");
+const require_dist = require("./dist-Df7s77se.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-DibNtLmU.js → retired-settings-keys-D-Xv1Zyv.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DLHPmdoV.js");
+const require_dist = require("./dist-Df7s77se.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-BHlKEYNL.mjs → retired-settings-keys-Wz92bcuK.mjs}

@@ -1,4 +1,4 @@
-import { vr as asJsonObject } from "./dist-C0wYvAHC.mjs";
+import { vr as asJsonObject } from "./dist-0OD9ue39.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.419",
+  "version": "1.2.421",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",