@camstack/system 1.2.428 → 1.2.430

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-DItkuOvu.js");
+const require_wal_maintenance = require("./wal-maintenance-BW1LIHi0.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Drqhcjit.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-vhPZLYuA.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/index.d.ts

@@ -16,11 +16,14 @@ export type { CreateLoginSessionInput, LoginSessionCheck, LoginSessionMethod, Lo
 export { LoginSessionManager, REFRESH_TOKEN_PREFIX } from "./auth/login-session-manager.js";
 export type { AdminTokenRecord } from "./auth/admin-token-manager.js";
 export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AdminTokenManager } from "./auth/admin-token-manager.js";
+export { DeviceCaStore } from "./auth/device-ca-store.js";
+export { DEVICE_CA_KEY_REF, type DeviceCaSigner, generateDeviceCa, issueDeviceLeaf, loadDeviceCa, verifyDeviceLeaf, verifyDeviceSignature } from "./auth/device-ca.js";
+export { type AuthenticatedDevice, DeviceCredentialManager, type DeviceCredentialRecord, type DeviceCredentialState, PREVIOUS_LEAF_GRACE_MS, type DeviceCheckRefusal, type IssuedDeviceCertificate } from "./auth/device-credential-manager.js";
 export { AuthAuditLog } from "./auth/auth-audit-log.js";
 export type { AuthAuditAction, AuthAuditEvent, AuthAuditRecord } from "./auth/auth-audit-log.js";
 export type { CidrMatcher, ParsedCidr, ParsedCidrList } from "./auth/cidr.js";
 export { createCidrMatcher, normalizeIp, parseCidrList, readCidrSetting } from "./auth/cidr.js";
-export type { AdminTokensInternal, AuthAuditInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal } from "./auth/user-management-internal.js";
+export type { AdminTokensInternal, AuthAuditInternal, DeviceCredentialsInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal } from "./auth/user-management-internal.js";
 export { attachUserManagementInternal, getUserManagementInternal, USER_MANAGEMENT_INTERNAL } from "./auth/user-management-internal.js";
 export type { UserRecord, UserStorageAccess } from "./auth/user-manager.js";
 export { FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, UserManager } from "./auth/user-manager.js";

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BQG3QFg7.js");
-const require_jwt_signing_key = require("./jwt-signing-key-BZm055IP.js");
+const require_dist = require("./dist-DxJdci75.js");
+const require_device_ca = require("./device-ca-CKiqh2Iu.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,20 +22,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-DItkuOvu.js");
+const require_wal_maintenance = require("./wal-maintenance-BW1LIHi0.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-CCSJGnjs.js");
+const require_agent_https_names = require("./agent-https-names-CpUSuP4w.js");
+const require_constants = require("./constants-BcNaVkvI.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_tls = require("./tls-BgImdxCO.js");
+const require_tls = require("./tls-C5IYg3V5.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-Dccm8lkA.js");
+const require_restore_archive = require("./restore-archive-CQJNoqRK.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -26892,6 +26893,8 @@ exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_
 exports.AGENT_CAP_FWD_ACTION = AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = AGENT_CAP_FWD_SERVICE;
 exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
+exports.AGENT_HTTPS_NAMES_COLLECTION = require_agent_https_names.AGENT_HTTPS_NAMES_COLLECTION;
+exports.AGENT_HTTPS_NAMES_COLUMNS = require_agent_https_names.AGENT_HTTPS_NAMES_COLUMNS;
 exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
 exports.AGENT_REGISTER_NODE_ACTION = AGENT_REGISTER_NODE_ACTION;
 exports.AGENT_UI_UNLOCK_DOMAIN = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_DOMAIN;
@@ -26911,6 +26914,8 @@ exports.AddonLoader = AddonLoader;
 exports.AddonManifest = AddonManifest;
 exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTokenManager;
+exports.AgentHttpsInstallError = require_tls.AgentHttpsInstallError;
+exports.AgentHttpsNames = require_agent_https_names.AgentHttpsNames;
 exports.AgentMeshAuthenticator = AgentMeshAuthenticator;
 exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
 exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
@@ -26952,9 +26957,12 @@ exports.DEFAULT_LAN_HTTP_PORT = require_tls.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
 exports.DEFAULT_MESH_JOIN_MAX_HELD = DEFAULT_MESH_JOIN_MAX_HELD;
 exports.DEFAULT_MESH_JOIN_MAX_HOLD_MS = DEFAULT_MESH_JOIN_MAX_HOLD_MS;
+exports.DEVICE_CA_KEY_REF = require_device_ca.DEVICE_CA_KEY_REF;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
+exports.DeviceCaStore = require_builtins_local_auth_local_auth_addon.DeviceCaStore;
+exports.DeviceCredentialManager = require_builtins_local_auth_local_auth_addon.DeviceCredentialManager;
 exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
 exports.DeviceRegistry = DeviceRegistry;
 exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
@@ -26993,10 +27001,10 @@ exports.HubLogForwarder = HubLogForwarder;
 exports.HubNodeRegistry = HubNodeRegistry;
 exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
-exports.JWT_SIGNING_KEY_REF = require_jwt_signing_key.JWT_SIGNING_KEY_REF;
+exports.JWT_SIGNING_KEY_REF = require_device_ca.JWT_SIGNING_KEY_REF;
 exports.JobJournal = JobJournal;
 exports.JoinTokenJtiStore = require_builtins_system_config_system_config_addon.JoinTokenJtiStore;
-exports.JwtSigningKeyUnavailableError = require_jwt_signing_key.JwtSigningKeyUnavailableError;
+exports.JwtSigningKeyUnavailableError = require_device_ca.JwtSigningKeyUnavailableError;
 exports.LEAF_RENEWAL_WINDOW_DAYS = require_tls.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
 exports.LifecycleStateMachine = LifecycleStateMachine;
@@ -27023,12 +27031,15 @@ exports.MESH_JOIN_CHALLENGE_ACTION = MESH_JOIN_CHALLENGE_ACTION;
 exports.MESH_JOIN_CHALLENGE_INVALID_TYPE = MESH_JOIN_CHALLENGE_INVALID_TYPE;
 exports.MESH_JOIN_CHALLENGE_TTL_MS = MESH_JOIN_CHALLENGE_TTL_MS;
 exports.MESH_JOIN_PROTOCOL = MESH_JOIN_PROTOCOL;
+exports.MESH_NODE_CERTIFICATES_COLLECTION = require_builtins_system_config_system_config_addon.MESH_NODE_CERTIFICATES_COLLECTION;
+exports.MESH_NODE_CERTIFICATES_COLUMNS = require_builtins_system_config_system_config_addon.MESH_NODE_CERTIFICATES_COLUMNS;
 exports.MESH_NODE_UNAUTHENTICATED_TYPE = MESH_NODE_UNAUTHENTICATED_TYPE;
 exports.MESH_QUEUE_TOP_N = MESH_QUEUE_TOP_N;
 exports.MESH_TLS_PORT_HELLO_FIELD = require_builtins_system_config_system_config_addon.MESH_TLS_PORT_HELLO_FIELD;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
 exports.MeshAuthenticator = MeshAuthenticator;
 exports.MeshCaKeeper = require_builtins_system_config_system_config_addon.MeshCaKeeper;
+exports.MeshCertificateRegistry = require_builtins_system_config_system_config_addon.MeshCertificateRegistry;
 exports.MeshCrl = require_builtins_system_config_system_config_addon.MeshCrl;
 exports.MeshJoinClient = MeshJoinClient;
 exports.MeshJoinHold = MeshJoinHold;
@@ -27043,6 +27054,7 @@ exports.OUTBOUND_QUEUE_COOLDOWN_MS = OUTBOUND_QUEUE_COOLDOWN_MS;
 exports.OUTBOUND_QUEUE_SUSTAIN_MS = OUTBOUND_QUEUE_SUSTAIN_MS;
 exports.OUTBOUND_QUEUE_THRESHOLD_BYTES = OUTBOUND_QUEUE_THRESHOLD_BYTES;
 exports.PARENT_ROUTED_PROVIDER_ADDON_ID = PARENT_ROUTED_PROVIDER_ADDON_ID;
+exports.PREVIOUS_LEAF_GRACE_MS = require_builtins_local_auth_local_auth_addon.PREVIOUS_LEAF_GRACE_MS;
 Object.defineProperty(exports, "PYTHON_VERSION", {
 	enumerable: true,
 	get: function() {
@@ -27055,6 +27067,7 @@ exports.PipelineValidator = PipelineValidator;
 exports.PythonEnvManager = PythonEnvManager;
 exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
 exports.REFRESH_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.REFRESH_TOKEN_PREFIX;
+exports.RENEWAL_ABANDONED = require_builtins_system_config_system_config_addon.RENEWAL_ABANDONED;
 exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
 exports.RSS_BUDGET_REANNOUNCE_MIN_MS = RSS_BUDGET_REANNOUNCE_MIN_MS;
 exports.RSS_BUDGET_RELEASE_RATIO = RSS_BUDGET_RELEASE_RATIO;
@@ -27071,7 +27084,7 @@ exports.SOCKET_QUEUE_TOP_N = SOCKET_QUEUE_TOP_N;
 exports.STALL_REPORT_MS = require_custom_action_registry.STALL_REPORT_MS;
 exports.STALL_TICK_MS = require_custom_action_registry.STALL_TICK_MS;
 exports.STORE_READABLE_BOOTSTRAP_KEYS = STORE_READABLE_BOOTSTRAP_KEYS;
-exports.SYSTEM_SECRET_OWNER = require_jwt_signing_key.SYSTEM_SECRET_OWNER;
+exports.SYSTEM_SECRET_OWNER = require_device_ca.SYSTEM_SECRET_OWNER;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SettingsReadUnavailableError = require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError;
@@ -27102,10 +27115,12 @@ exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLogg
 exports.ZERO_LOOP_DELAY = ZERO_LOOP_DELAY;
 exports.__resetCapUsageRegistryForTests = __resetCapUsageRegistryForTests;
 exports.__resetLoggingGateForTests = __resetLoggingGateForTests;
+exports.acceptAgentSans = require_tls.acceptAgentSans;
 exports.adaptBrokerToCluster = adaptBrokerToCluster;
 exports.addonSettingsCapability = require_dist.addonSettingsCapability;
 exports.adoptModelRevisions = require_custom_action_registry.adoptModelRevisions;
 exports.afterWorkerOnlineAnnounce = afterWorkerOnlineAnnounce;
+exports.agentHttpsPaths = require_tls.agentHttpsPaths;
 exports.allFamiliesListenHost = require_tls.allFamiliesListenHost;
 exports.answerClaimedGetStatus = answerClaimedGetStatus;
 exports.applyCertificateToListener = require_tls.applyCertificateToListener;
@@ -27140,6 +27155,7 @@ exports.capActionName = capActionName;
 exports.capActionSuffix = capActionSuffix;
 exports.capBareAction = capBareAction;
 exports.capServiceName = capServiceName;
+exports.certificateNames = require_tls.certificateNames;
 exports.checkClusterSecret = require_constants.checkClusterSecret;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = classifyCapRoute;
@@ -27149,6 +27165,7 @@ exports.clearPlatformKeychainKey = require_platform_key_source.clearPlatformKeyc
 exports.closeLanHttp = require_tls.closeLanHttp;
 exports.clusterEventTopic = clusterEventTopic;
 exports.clusterSecretMatches = require_constants.clusterSecretMatches;
+exports.collectAgentNames = require_tls.collectAgentNames;
 exports.collectCertIdentity = require_tls.collectCertIdentity;
 exports.collectModelFiles = require_custom_action_registry.collectModelFiles;
 exports.computeHubJoinProof = computeHubJoinProof;
@@ -27161,6 +27178,7 @@ exports.createAddonDataPlaneFacility = createAddonDataPlaneFacility;
 exports.createAddonPeerBytesFacility = createAddonPeerBytesFacility;
 exports.createAddonService = createAddonService;
 exports.createAgentEventScope = createAgentEventScope;
+exports.createAgentHttpsRequest = require_tls.createAgentHttpsRequest;
 exports.createArrayBufferCensusGate = createArrayBufferCensusGate;
 exports.createAuthenticatedFileServer = require_custom_action_registry.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
@@ -27202,6 +27220,8 @@ exports.createV8Reclaimer = createV8Reclaimer;
 exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
 exports.deleteModelFromDisk = require_custom_action_registry.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
+exports.describeHttpsLeaf = require_tls.describeHttpsLeaf;
+exports.describeMeshLeaf = require_builtins_system_config_system_config_addon.describeMeshLeaf;
 exports.describeProviderKindDrift = describeProviderKindDrift;
 exports.describeRss = describeRss;
 exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
@@ -27218,8 +27238,10 @@ Object.defineProperty(exports, "downloadBinary", {
 });
 exports.downloadFile = require_custom_action_registry.downloadFile;
 exports.downloadModel = require_custom_action_registry.downloadModel;
+exports.dropProcessPeer = require_builtins_system_config_system_config_addon.dropProcessPeer;
 exports.emitDownForOwnedCaps = require_dist.emitDownForOwnedCaps;
 exports.emitHeapDiagnosticReport = emitHeapDiagnosticReport;
+exports.emitProcessNodeRegistered = require_builtins_system_config_system_config_addon.emitProcessNodeRegistered;
 exports.encodeFrame = encodeFrame;
 exports.enrollMeshNode = require_builtins_system_config_system_config_addon.enrollMeshNode;
 exports.ensureAddonNativePrebuilds = ensureAddonNativePrebuilds;
@@ -27264,6 +27286,7 @@ exports.formatMeshQueue = formatMeshQueue;
 exports.formatOutboundQueueVerdict = formatOutboundQueueVerdict;
 exports.formatSocketPlane = formatSocketPlane;
 exports.generateBackupKeyPair = require_restore_archive.generateBackupKeyPair;
+exports.generateDeviceCa = require_device_ca.generateDeviceCa;
 exports.generateMeshCa = require_builtins_system_config_system_config_addon.generateMeshCa;
 exports.generateMeshKeyPair = require_builtins_system_config_system_config_addon.generateMeshKeyPair;
 exports.getBrokerEventBus = getBrokerEventBus;
@@ -27288,12 +27311,16 @@ Object.defineProperty(exports, "getPlatformInfo", {
 	}
 });
 exports.getPlatformKeychainKey = require_platform_key_source.getPlatformKeychainKey;
+exports.getProcessAgentHttpsNames = require_agent_https_names.getProcessAgentHttpsNames;
 exports.getProcessClusterSecretGate = require_constants.getProcessClusterSecretGate;
-exports.getProcessJwtSigningKeyState = require_jwt_signing_key.getProcessJwtSigningKeyState;
+exports.getProcessJwtSigningKeyState = require_device_ca.getProcessJwtSigningKeyState;
 exports.getProcessMeshAuthMode = require_builtins_system_config_system_config_addon.getProcessMeshAuthMode;
 exports.getProcessMeshAuthStatus = require_builtins_system_config_system_config_addon.getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = require_builtins_system_config_system_config_addon.getProcessMeshCaState;
+exports.getProcessMeshCertificateRegistry = require_builtins_system_config_system_config_addon.getProcessMeshCertificateRegistry;
+exports.getProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.getProcessMeshTlsListenerState;
 exports.getProcessNodeMeshTransport = require_builtins_system_config_system_config_addon.getProcessNodeMeshTransport;
+exports.getProcessPeerLeaf = require_builtins_system_config_system_config_addon.getProcessPeerLeaf;
 Object.defineProperty(exports, "getPythonDownloadUrl", {
 	enumerable: true,
 	get: function() {
@@ -27309,6 +27336,7 @@ exports.hashClusterSecret = require_constants.hashClusterSecret;
 exports.heapSpaceField = heapSpaceField;
 exports.hostNodeIdOf = hostNodeIdOf;
 exports.hubMainRssBudget = hubMainRssBudget;
+exports.installAgentHttps = require_tls.installAgentHttps;
 exports.installManifestNativeDeps = installManifestNativeDeps;
 exports.installManifestPythonDeps = installManifestPythonDeps;
 exports.installManifestSystemDeps = installManifestSystemDeps;
@@ -27332,20 +27360,27 @@ exports.isArrayBufferCensusReport = isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isClusterSecretMismatchError = require_constants.isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
+exports.isContainerBridgeAddress = require_tls.isContainerBridgeAddress;
 exports.isCredentialKeyName = isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
+exports.isLocalOnlyHostname = require_tls.isLocalOnlyHostname;
 exports.isMeshAuthMode = require_builtins_system_config_system_config_addon.isMeshAuthMode;
 exports.isModelDownloaded = require_custom_action_registry.isModelDownloaded;
 exports.isOwnChildNodeId = isOwnChildNodeId;
 exports.isPeerEventPacket = isPeerEventPacket;
+exports.isPrivateAddress = require_tls.isPrivateAddress;
 exports.isRemoteForbiddenAction = isRemoteForbiddenAction;
 exports.isRemoteForbiddenOnAgent = isRemoteForbiddenOnAgent;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
 exports.isSourceNewer = isSourceNewer;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
+exports.issueAgentHttpsLeaf = require_tls.issueAgentHttpsLeaf;
+exports.issueDeviceLeaf = require_device_ca.issueDeviceLeaf;
 exports.issueMeshLeafForNode = require_builtins_system_config_system_config_addon.issueMeshLeafForNode;
 exports.issueMeshLeafFromCsr = require_builtins_system_config_system_config_addon.issueMeshLeafFromCsr;
 exports.leafFingerprintOf = require_tls.leafFingerprintOf;
+exports.loadAgentHttps = require_tls.loadAgentHttps;
+exports.loadDeviceCa = require_device_ca.loadDeviceCa;
 exports.loadMeshCa = require_builtins_system_config_system_config_addon.loadMeshCa;
 exports.loadTlsCert = require_tls.loadTlsCert;
 exports.localEndpointPath = localEndpointPath;
@@ -27358,6 +27393,8 @@ exports.mintMeshJoinToken = require_builtins_system_config_system_config_addon.m
 exports.mountNativeCapService = mountNativeCapService;
 exports.nextRssBudgetState = nextRssBudgetState;
 exports.normalizeIp = require_builtins_system_config_system_config_addon.normalizeIp;
+exports.onProcessNodeRegistered = require_builtins_system_config_system_config_addon.onProcessNodeRegistered;
+exports.openMeshTlsWhenRevocationsLoaded = require_builtins_system_config_system_config_addon.openMeshTlsWhenRevocationsLoaded;
 exports.overlayGetStatus = overlayGetStatus;
 exports.parseAgentDashboardOrigins = require_builtins_system_config_system_config_addon.parseAgentDashboardOrigins;
 exports.parseCapAction = parseCapAction;
@@ -27368,11 +27405,13 @@ exports.parseRssBudgetMb = parseRssBudgetMb;
 exports.parseTokenExpiry = require_builtins_local_auth_local_auth_addon.parseTokenExpiry;
 exports.parseTokenizedUrl = require_custom_action_registry.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
+exports.pemDigest = require_tls.pemDigest;
+exports.pinnedHttpsCaFingerprint = require_tls.pinnedHttpsCaFingerprint;
 exports.prepareBootTls = require_tls.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
 exports.probePlatform = probePlatform;
 exports.processJoinTokenJtiStore = require_builtins_system_config_system_config_addon.processJoinTokenJtiStore;
-exports.processJwtSigningKey = require_jwt_signing_key.processJwtSigningKey;
+exports.processJwtSigningKey = require_device_ca.processJwtSigningKey;
 exports.processMeshCrl = require_builtins_system_config_system_config_addon.processMeshCrl;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
@@ -27397,6 +27436,7 @@ exports.registerHttpsListener = require_tls.registerHttpsListener;
 exports.registerLanHttpHandler = require_tls.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_tls.reissueTlsLeaf;
 exports.reloadHttpsListener = require_tls.reloadHttpsListener;
+exports.renewMeshCertificate = require_builtins_system_config_system_config_addon.renewMeshCertificate;
 exports.requestProcessMeshEnforcement = require_builtins_system_config_system_config_addon.requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = require_builtins_system_config_system_config_addon.requireProcessMeshCa;
 exports.resolveFilePath = require_custom_action_registry.resolveFilePath;
@@ -27405,6 +27445,7 @@ exports.resolveHwAccel = resolveHwAccel;
 exports.resolveNpmInvocation = resolveNpmInvocation;
 exports.revertToGeneratedCertificate = require_tls.revertToGeneratedCertificate;
 exports.revisionWeightUrl = require_custom_action_registry.revisionWeightUrl;
+exports.revokeMeshCertificate = require_builtins_system_config_system_config_addon.revokeMeshCertificate;
 exports.runHubAddonBoot = runHubAddonBoot;
 exports.runNpm = runNpm;
 exports.sampleSocketDirection = sampleSocketDirection;
@@ -27419,12 +27460,15 @@ exports.servedHttpsLeafFingerprint = require_tls.servedHttpsLeafFingerprint;
 exports.setHubConnected = setHubConnected;
 exports.setNodeEventInterest = setNodeEventInterest;
 exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychainKey;
+exports.setProcessAgentHttpsNames = require_agent_https_names.setProcessAgentHttpsNames;
 exports.setProcessClusterSecretGate = require_constants.setProcessClusterSecretGate;
 exports.setProcessMeshAuthMode = require_builtins_system_config_system_config_addon.setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = require_builtins_system_config_system_config_addon.setProcessMeshAuthStatusSource;
+exports.setProcessMeshCertificateRegistry = require_builtins_system_config_system_config_addon.setProcessMeshCertificateRegistry;
 exports.setProcessMeshEnforcer = require_builtins_system_config_system_config_addon.setProcessMeshEnforcer;
 exports.setProcessMeshPeerTransportLookup = require_builtins_system_config_system_config_addon.setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_addon.setProcessMeshTlsEnabler;
+exports.setProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.setProcessMeshTlsListenerState;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = shouldReclaim;
 exports.signalAllRunnerGroups = signalAllRunnerGroups;
@@ -27435,7 +27479,7 @@ exports.stampCallerAddonId = stampCallerAddonId;
 exports.startEventLoopStallMonitor = require_custom_action_registry.startEventLoopStallMonitor;
 exports.startHeapWatch = startHeapWatch;
 exports.startRunnerHeapWatch = startRunnerHeapWatch;
-exports.staticJwtSigningKey = require_jwt_signing_key.staticJwtSigningKey;
+exports.staticJwtSigningKey = require_device_ca.staticJwtSigningKey;
 exports.storeMayAnswer = storeMayAnswer;
 exports.storeUploadedCertificate = require_tls.storeUploadedCertificate;
 exports.strandedMb = strandedMb;
@@ -27443,10 +27487,13 @@ exports.stripCamstackDeps = stripCamstackDeps;
 exports.stripForgedIdentity = stripForgedIdentity;
 exports.stripForwardedCaller = require_builtins_storage_orchestrator_storage_orchestrator_addon.stripForwardedCaller;
 exports.subscribePassthrough = subscribePassthrough;
+exports.systemHostFacts = require_tls.systemHostFacts;
 exports.udsChildLogToWorkerEntry = udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = validateProviderRegistrations;
 exports.validateUploadedTls = require_tls.validateUploadedTls;
 exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;
+exports.verifyDeviceLeaf = require_device_ca.verifyDeviceLeaf;
+exports.verifyDeviceSignature = require_device_ca.verifyDeviceSignature;
 exports.verifyMeshJoinToken = require_builtins_system_config_system_config_addon.verifyMeshJoinToken;
 exports.waitUntilReady = waitUntilReady;
 exports.writeExtraSans = require_tls.writeExtraSans;

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $t as looseSchema, Ar as expandCapMethods, Dn as scopesAllowAddon, G as addonSettingsCapability, Gr as readinessKey, Hr as parseJsonObject, Ht as isVoidInput, Jr as scopeKey, Jt as lifecycleJobSchema, Kr as resolveCapMount, Lt as isArrayOutputSchema, On as scopesAllowDeviceCap, Or as emitDownForOwnedCaps, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Tr as createEvent$1, Ur as parseJsonUnknown, Ut as kebabToCamel$1, Vt as isObjectInput, br as asNumber, cn as objectInputDeclaresAddonId, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, gr as ReadinessTimeoutError, hr as ReadinessRegistry, j as METHOD_ACCESS_MAP, jt as extractNestedAddonId, k as LOG_LEVEL_RANK, ln as objectInputDeclaresRequiredDeviceId, mn as procedureAuthKey, mr as RUNTIME_DEFAULTS, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory$1, ur as DATAPLANE_SECRET_HEADER$1, wn as resolveMethodAuth, xr as asString$1, yr as asJsonObject$1, zn as supportedRuntimes } from "./dist-DHSJV4Qc.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-DL-qk1SM.mjs";
+import { $r as readinessKey, Cr as ReadinessRegistry, Dr as asJsonObject$1, F as METHOD_ACCESS_MAP, Fn as scopesAllowAddon, Gt as isArrayOutputSchema, In as scopesAllowDeviceCap, Ir as emitDownForOwnedCaps, Kt as isCollectionArrayMethod, Mn as resolveMethodAuth, N as LOG_LEVEL_RANK, Nr as createEvent$1, Or as asNumber, Rr as expandCapMethods, Rt as extractNestedAddonId, Sn as procedureAuthKey, Sr as RUNTIME_DEFAULTS, Xr as parseJsonObject, Xt as isVoidInput, Y as addonSettingsCapability, Yt as isObjectInput, Zr as parseJsonUnknown, Zt as kebabToCamel$1, _n as objectInputDeclaresRequiredDeviceId, br as DEVICE_STATUS_METHOD, ei as resolveCapMount, gn as objectInputDeclaresAddonId, gr as errMsg$1, kr as asString$1, li as EventCategory$1, ni as scopeKey, nn as lifecycleJobSchema, on as logLevelAtMost, qn as supportedRuntimes, sn as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, vr as DATAPLANE_SECRET_HEADER$1, wr as ReadinessTimeoutError, yr as DEVICE_SETTINGS_CONTRIBUTION_METHODS } from "./dist-CXG6muCR.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-B-BTxeCj.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -16,25 +16,26 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, _ as isSettingsReadUnavailable, a as attachUserManagementInternal, c as ADMIN_TOKEN_MAX_LIFETIME_MS, d as LoginSessionManager, f as REFRESH_TOKEN_PREFIX, g as SettingsReadUnavailableError, h as parseTokenExpiry, i as USER_MANAGEMENT_INTERNAL, l as ADMIN_TOKEN_PREFIX, m as AuthManager, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as ScopedTokenManager, r as UserManager, s as AuthAuditLog, t as FIRST_BOOT_ADMIN_PASSWORD, u as AdminTokenManager, v as ApiKeyManager } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, _ as AuthManager, a as attachUserManagementInternal, b as isSettingsReadUnavailable, c as DeviceCredentialManager, d as ADMIN_TOKEN_MAX_LIFETIME_MS, f as ADMIN_TOKEN_PREFIX, g as ScopedTokenManager, h as REFRESH_TOKEN_PREFIX, i as USER_MANAGEMENT_INTERNAL, l as PREVIOUS_LEAF_GRACE_MS, m as LoginSessionManager, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as AdminTokenManager, r as UserManager, s as AuthAuditLog, t as FIRST_BOOT_ADMIN_PASSWORD, u as DeviceCaStore, v as parseTokenExpiry, x as ApiKeyManager, y as SettingsReadUnavailableError } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-Drqhcjit.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-vhPZLYuA.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CR4If_lP.mjs";
-import { A as AGENT_UI_UNLOCK_TTL_MS, B as isMeshAuthMode, C as generateMeshCa, D as loadMeshCa, E as issueMeshLeafFromCsr, F as parseAgentDashboardOrigins, G as setProcessMeshEnforcer, H as requestProcessMeshEnforcement, I as verifyAgentUiUnlockTicket, J as parseCidrList, K as createCidrMatcher, L as MESH_AUTH_MODE_FIELD, M as UnlockTicketJtiStore, N as isAllowedAgentDashboardReturnTo, O as AGENT_DASHBOARD_ORIGINS_FIELD, P as mintAgentUiUnlockTicket, R as getProcessMeshAuthMode, S as exportMeshPrivateKeyPem, SystemConfigAddon, T as issueMeshLeafForNode, U as setProcessMeshAuthMode, V as parseMeshAuthMode, W as setProcessMeshAuthStatusSource, Y as readCidrSetting, _ as getProcessMeshCaState, a as ServiceBroker, b as caFingerprintCompact, c as JoinTokenJtiStore, d as verifyMeshJoinToken, f as getProcessNodeMeshTransport, g as MeshCaKeeper, h as processMeshCrl, i as Errors, j as AGENT_UI_UNLOCK_VERSION, k as AGENT_UI_UNLOCK_DOMAIN, l as mintMeshJoinToken, m as MeshCrl, n as MESH_TLS_PORT_HELLO_FIELD, o as setProcessMeshTlsEnabler, p as setProcessMeshPeerTransportLookup, q as normalizeIp, r as TlsTcpTransporter, s as enrollMeshNode, u as processJoinTokenJtiStore, v as requireProcessMeshCa, w as generateMeshKeyPair, x as createMeshCsrPem, y as caFingerprint, z as getProcessMeshAuthStatus } from "./builtins/system-config/system-config.addon.mjs";
+import { a as setProcessAgentHttpsNames, i as getProcessAgentHttpsNames, n as AGENT_HTTPS_NAMES_COLUMNS, r as AgentHttpsNames, t as AGENT_HTTPS_NAMES_COLLECTION } from "./agent-https-names-uetr4OQl.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CttE77VF.mjs";
+import { $ as MESH_AUTH_MODE_FIELD, A as MeshCrl, B as generateMeshKeyPair, C as MESH_NODE_CERTIFICATES_COLLECTION, D as describeMeshLeaf, E as RENEWAL_ABANDONED, F as caFingerprint, G as AGENT_UI_UNLOCK_DOMAIN, H as issueMeshLeafFromCsr, I as caFingerprintCompact, J as UnlockTicketJtiStore, K as AGENT_UI_UNLOCK_TTL_MS, L as createMeshCsrPem, M as MeshCaKeeper, N as getProcessMeshCaState, O as getProcessMeshCertificateRegistry, P as requireProcessMeshCa, Q as verifyAgentUiUnlockTicket, R as exportMeshPrivateKeyPem, S as setProcessMeshTlsListenerState, SystemConfigAddon, T as MeshCertificateRegistry, U as loadMeshCa, V as issueMeshLeafForNode, W as AGENT_DASHBOARD_ORIGINS_FIELD, X as mintAgentUiUnlockTicket, Y as isAllowedAgentDashboardReturnTo, Z as parseAgentDashboardOrigins, _ as setProcessMeshPeerTransportLookup, a as ServiceBroker, at as setProcessMeshAuthMode, b as getProcessMeshTlsListenerState, c as JoinTokenJtiStore, ct as createCidrMatcher, d as verifyMeshJoinToken, dt as readCidrSetting, et as getProcessMeshAuthMode, f as dropProcessPeer, g as onProcessNodeRegistered, h as getProcessPeerLeaf, i as Errors, it as requestProcessMeshEnforcement, j as processMeshCrl, k as setProcessMeshCertificateRegistry, l as mintMeshJoinToken, lt as normalizeIp, m as getProcessNodeMeshTransport, n as MESH_TLS_PORT_HELLO_FIELD, nt as isMeshAuthMode, o as setProcessMeshTlsEnabler, ot as setProcessMeshAuthStatusSource, p as emitProcessNodeRegistered, q as AGENT_UI_UNLOCK_VERSION, r as TlsTcpTransporter, rt as parseMeshAuthMode, s as enrollMeshNode, st as setProcessMeshEnforcer, tt as getProcessMeshAuthStatus, u as processJoinTokenJtiStore, ut as parseCidrList, v as renewMeshCertificate, w as MESH_NODE_CERTIFICATES_COLUMNS, x as openMeshTlsWhenRevocationsLoaded, y as revokeMeshCertificate, z as generateMeshCa } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
+import { A as readTlsMode, B as CA_VALIDITY_DAYS, C as registerHttpsListener, D as UPLOADED_CA_FILE, E as prepareBootTls, F as loadTlsCert, G as DEFAULT_LAN_HTTP_PORT, H as MAX_LEAF_VALIDITY_DAYS, I as reissueTlsLeaf, J as bindPendingLanHttp, K as allFamiliesListenHost, L as CA_COMMON_NAME, M as writeExtraSans, N as writeTlsMode, O as readExtraSans, P as ensureTlsCert, R as collectCertIdentity, S as leafFingerprintOf, T as servedHttpsLeafFingerprint, U as SERVER_AUTH_OID, V as LEAF_RENEWAL_WINDOW_DAYS, W as evaluateExistingCert, X as readLanHttpState, Y as closeLanHttp, Z as registerLanHttpHandler, _ as regenerateCertificate, a as collectAgentNames, b as validateUploadedTls, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as applyCertificateToListener, h as pinnedHttpsCaFingerprint, i as certificateNames, j as splitPemCertificates, k as readTlsAccessStatus, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, q as applyLanHttp, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, v as revertToGeneratedCertificate, w as reloadHttpsListener, x as clearHttpsListener, y as storeUploadedCertificate, z as systemHostFacts } from "./tls-CpcGkeJV.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DH1Pxq_1.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-D_wBL1OO.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -26884,4 +26885,4 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectAgentNames, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installAgentHttps, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isLocalOnlyHostname, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isPrivateAddress, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshCertificateRegistry, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -39,8 +39,8 @@ export { buildStorageLocationRegistry } from "./storage-location-registry.js";
 export type { StorageLocationRegistry } from "./storage-location-registry.js";
 export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter } from "./moleculer/broker-factory.js";
 export type { BrokerConfig } from "./moleculer/broker-factory.js";
-export { caFingerprint, caFingerprintCompact, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
-export type { MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
+export { caFingerprint, caFingerprintCompact, describeMeshLeaf, dropProcessPeer, emitProcessNodeRegistered, onProcessNodeRegistered, getProcessMeshCertificateRegistry, getProcessPeerLeaf, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, getProcessMeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, RENEWAL_ABANDONED, setProcessMeshTlsListenerState, renewMeshCertificate, revokeMeshCertificate, setProcessMeshCertificateRegistry, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
+export type { MeshCertificateRecord, MeshLeafDescription, MeshLog, MeshPeerLeaf, MeshPeers, MeshRegistrations, MeshTlsListenerState, NodeMeshClient, RenewMeshResult, RevokeMeshResult, MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
 export { type AddonDeploySource, isAddonDeploySource } from "./moleculer/addon-deploy-source.js";
 export { createAddonService, validateProviderRegistrations } from "./moleculer/addon-service-factory.js";
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from "./moleculer/core-cap-service.js";

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -2,7 +2,10 @@ export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_C
 export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial } from "./mesh-ca.js";
 export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState } from "./mesh-ca-keeper.js";
 export { clearProcessMeshCrl, MeshCrl, processMeshCrl } from "./mesh-crl.js";
-export { getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
+export { describeMeshLeaf, getProcessMeshCertificateRegistry, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, RENEWAL_ABANDONED, setProcessMeshCertificateRegistry, type MeshCertificateRecord, type MeshCertificateVia, type MeshLeafDescription } from "./mesh-certificate-registry.js";
+export { getProcessMeshTlsListenerState, type MeshTlsGateDeps, type MeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, setProcessMeshTlsListenerState } from "./mesh-tls-gate.js";
+export { renewMeshCertificate, revokeMeshCertificate, type MeshLog, type MeshPeers, type MeshRegistrations, type NodeMeshClient, type RenewMeshDeps, type RenewMeshResult, type RevokeMeshResult } from "./mesh-renewal.js";
+export { dropProcessPeer, emitProcessNodeRegistered, getProcessPeerLeaf, onProcessNodeRegistered, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, type MeshPeerLeaf, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
 export { enrollMeshNode } from "./mesh-enroll.js";
 export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult } from "./mesh-enroll.js";
 export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput } from "./mesh-join-token.js";

package/dist/kernel/moleculer/mesh-mtls/mesh-certificate-registry.d.ts

@@ -0,0 +1,91 @@
+import type { CollectionColumn, IScopedLogger, SettingsStoreClient } from "@camstack/types";
+import type { MeshCrl } from "./mesh-crl.js";
+/**
+* @durable class=config owner=system-config
+*   write="the hub records every mesh leaf it issues (enroll, renewal, boot) and every
+*     leaf a connected node is observed presenting; a revocation stamps revokedAt"
+*   retention="a revoked or expired row is kept 90 days past its end, then reaped; a
+*     live row is never deleted. Forgetting a node does not delete its rows."
+*/
+export declare const MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
+export declare const MESH_NODE_CERTIFICATES_COLUMNS: readonly CollectionColumn[];
+export type MeshCertificateVia = "enroll" | "renewal" | "boot" | "observed";
+export interface MeshCertificateRecord {
+	readonly nodeId: string;
+	readonly serial: string;
+	readonly fingerprint: string;
+	readonly notBefore: number;
+	readonly notAfter: number;
+	readonly issuedAt: number;
+	readonly issuedVia: MeshCertificateVia;
+	readonly revokedAt: number | null;
+	readonly revokedReason: string | null;
+}
+export interface MeshLeafDescription {
+	readonly cn: string;
+	readonly serial: string;
+	readonly fingerprint: string;
+	readonly notBefore: number;
+	readonly notAfter: number;
+}
+/**
+* A leaf the hub signed for a renewal that did not complete. It must not be the node's
+* `current` leaf, but it is NOT on the CRL: the node may still hold it (the swap
+* could have landed without the hub seeing it), and cutting it off would be the
+* outage the hand-over exists to prevent. If the node is later seen presenting it, it
+* is reinstated.
+*/
+export declare const RENEWAL_ABANDONED = "renewal-abandoned";
+/** CN, serial, fingerprint and validity of a leaf PEM (or DER). */
+export declare function describeMeshLeaf(cert: string | Buffer): MeshLeafDescription;
+export declare class MeshCertificateRegistry {
+	private readonly store;
+	private readonly deps;
+	private readonly rows;
+	constructor(store: SettingsStoreClient, deps?: {
+		readonly now?: () => number;
+		readonly logger?: IScopedLogger;
+	});
+	private now;
+	load(): Promise<void>;
+	/** Write down a leaf the hub just issued. Idempotent per fingerprint. */
+	recordIssued(nodeId: string, certPem: string, via: Exclude<MeshCertificateVia, "observed">): Promise<MeshCertificateRecord>;
+	/**
+	* A node was seen presenting `leaf` on its live connection. A leaf the hub already
+	* knows is left alone; an unknown one is recorded `observed` (a node enrolled
+	* before this record existed).
+	*/
+	recordObserved(nodeId: string, leaf: MeshLeafDescription): Promise<boolean>;
+	list(nodeId?: string): readonly MeshCertificateRecord[];
+	/** The newest non-revoked leaf of a node, or `undefined`. */
+	currentFor(nodeId: string): MeshCertificateRecord | undefined;
+	/** Every non-revoked leaf of a node (a renewal in flight has two). */
+	liveFor(nodeId: string): readonly MeshCertificateRecord[];
+	/** Stamp a leaf revoked (and mirror it into `crl`). `false` when unknown or already revoked. */
+	revoke(fingerprint: string, reason: string, crl?: MeshCrl): Promise<boolean>;
+	/**
+	* Operator revocation of a whole node: EVERY leaf of the node that is not already on the
+	* CRL goes on it - the current one, an observed one, a renewal one, and a leaf that was set
+	* aside (`renewal-abandoned`: a copy of it may sit on a stolen box, and it must not stay
+	* valid just because the hub once set it aside). Returns the serials put on the CRL.
+	* A leaf revoked this way is never reinstated by `recordObserved`.
+	*/
+	revokeAllForNode(nodeId: string, reason: string, crl: MeshCrl): Promise<readonly string[]>;
+	/**
+	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
+	* newer (renewal) one is set aside - it is not the node's current leaf until the node is
+	* seen presenting it, which reinstates it. It is NOT put on the CRL.
+	*/
+	settleInterruptedRenewals(): Promise<number>;
+	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	abandon(fingerprint: string): Promise<boolean>;
+	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
+	restoreCrl(crl: MeshCrl): number;
+	/** Is `serial` listed as revoked here? */
+	isRevoked(serial: string): boolean;
+	reap(): Promise<number>;
+	private insert;
+	private persist;
+}
+export declare function setProcessMeshCertificateRegistry(registry: MeshCertificateRegistry | null): void;
+export declare function getProcessMeshCertificateRegistry(): MeshCertificateRegistry | null;

package/dist/kernel/moleculer/mesh-mtls/mesh-enroll.d.ts

@@ -25,6 +25,10 @@ export interface EnrollMeshNodeDeps {
 	readonly ca: MeshCaSigner;
 	readonly jtiStore?: JoinTokenJtiStore;
 	readonly now?: Date;
+	/** Called with every leaf the hub issues, before the answer is returned (the registry write). */
+	readonly onIssued?: (nodeId: string, certPem: string) => Promise<void>;
+	/** The leaf is valid without its record; say it was not recorded (the node is observed on connect). */
+	readonly onRecordFailed?: (nodeId: string, error: unknown) => void;
 }
 export declare function enrollMeshNode(body: MeshEnrollRequest, deps: EnrollMeshNodeDeps): Promise<MeshEnrollResult>;
 export type { MeshJoinTokenClaims };