@camstack/system 1.2.430 → 1.2.431

package/dist/builtins/system-config/system-config.addon.js

@@ -792,7 +792,7 @@ var MeshCertificateRegistry = class {
 	async recordObserved(nodeId, leaf) {
 		const known = this.rows.get(leaf.fingerprint);
 		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return false;
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
 			const reinstated = {
 				...known,
 				revokedAt: null,
@@ -908,6 +908,29 @@ var MeshCertificateRegistry = class {
 		return settled;
 	}
 	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
 	async abandon(fingerprint) {
 		const record = this.rows.get(fingerprint);
 		if (record === void 0 || record.revokedAt !== null) return false;
@@ -1063,6 +1086,24 @@ function message$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 async function renewMeshCertificate(deps) {
+	const inFlight = { fingerprint: null };
+	try {
+		return await runRenewal(deps, inFlight);
+	} finally {
+		if (inFlight.fingerprint !== null) {
+			deps.registry.endRenewal(inFlight.fingerprint);
+			const live = deps.peers.peerLeaf(deps.nodeId);
+			if (live !== void 0) await deps.registry.recordObserved(deps.nodeId, {
+				cn: deps.nodeId,
+				serial: live.serial,
+				fingerprint: live.fingerprint,
+				notBefore: live.notBefore,
+				notAfter: live.notAfter
+			}).catch(() => void 0);
+		}
+	}
+}
+async function runRenewal(deps, inFlight) {
 	const { nodeId, log } = deps;
 	const tags = { nodeId };
 	const sleep = deps.sleep ?? defaultSleep;
@@ -1124,12 +1165,28 @@ async function renewMeshCertificate(deps) {
 		return fail("issue", message$1(error), true);
 	}
 	const newLeaf = describeMeshLeaf(issued.certPem);
+	deps.registry.beginRenewal(newLeaf.fingerprint);
+	inFlight.fingerprint = newLeaf.fingerprint;
 	let resolveRegistered = () => void 0;
 	const registeredPromise = new Promise((resolve) => {
 		resolveRegistered = resolve;
 	});
-	const unsubscribe = deps.registrations.subscribe((id) => {
-		if (id === nodeId && deps.peers.peerLeaf(nodeId)?.fingerprint === newLeaf.fingerprint) resolveRegistered(true);
+	const expected = deps.expectedAddons?.(nodeId) ?? [];
+	let missingAddons = [];
+	const unsubscribe = deps.registrations.subscribe((id, addonIds) => {
+		if (id !== nodeId || deps.peers.peerLeaf(nodeId)?.fingerprint !== newLeaf.fingerprint) return;
+		if (addonIds !== void 0) {
+			const present = new Set(addonIds);
+			missingAddons = expected.filter((addonId) => !present.has(addonId));
+			if (missingAddons.length > 0) {
+				log.warn("Mesh renewal: the node registered without addons it had before - waiting", {
+					tags,
+					meta: { missing: missingAddons }
+				});
+				return;
+			}
+		}
+		resolveRegistered(true);
 	});
 	const deadlineTimer = setTimer(() => resolveRegistered(false), timeoutMs);
 	registeredPromise.then(() => deadlineTimer.cancel());
@@ -1160,7 +1217,8 @@ async function renewMeshCertificate(deps) {
 			}
 		});
 		await deps.registry.abandon(newLeaf.fingerprint);
-		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s; the previous leaf was kept and is still valid`, true);
+		const lost = missingAddons.length > 0 ? ` (its last registration lacked ${missingAddons.length} addon(s) it had before: ${missingAddons.slice(0, 5).join(", ")}; the swap was rolled back and nothing was revoked - once those addons are running again the next renewal will go through)` : "";
+		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s${lost}; the previous leaf was kept and is still valid`, true);
 	}
 	log.info("Mesh renewal: the node registered presenting the new leaf", { tags });
 	let confirmError = "the node did not confirm the new leaf";
@@ -1280,10 +1338,14 @@ function onProcessNodeRegistered(listener) {
 		listeners.delete(listener);
 	};
 }
-/** Called by the hub when a node's `registerNode` has been applied. */
-function emitProcessNodeRegistered(nodeId) {
+/**
+* Called by the hub when a node's `registerNode` has been applied. `addonIds` is what that
+* registration carried (a node's own addons and its children's, D3), so a waiter can tell the
+* registration of a node that came back WHOLE from the first one of a node that lost its children.
+*/
+function emitProcessNodeRegistered(nodeId, addonIds) {
 	for (const listener of [...registrationListeners()]) try {
-		listener(nodeId);
+		listener(nodeId, addonIds);
 	} catch {}
 }
 //#endregion
@@ -87836,6 +87898,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			});
 			server.on("error", (err) => {
 				this.logger.error("Mesh TLS server error.", err);
+				if (this.tlsServer === server) this.tlsServer = null;
 				reject(err);
 			});
 			server.listen({
@@ -87845,9 +87908,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 				const address = server.address();
 				const port = address !== null && typeof address === "object" ? address.port : tlsPort;
 				this.logger.info(`Mesh TLS server is listening on port ${port}`);
+				this.tlsServer = server;
 				resolve();
 			});
-			this.tlsServer = server;
 		});
 	}
 	onTlsClientConnected(socket) {
@@ -88676,6 +88739,7 @@ exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
+exports.Transporters = Transporters;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -783,7 +783,7 @@ var MeshCertificateRegistry = class {
 	async recordObserved(nodeId, leaf) {
 		const known = this.rows.get(leaf.fingerprint);
 		if (known !== void 0) {
-			if (known.revokedReason !== "renewal-abandoned") return false;
+			if (known.revokedReason !== "renewal-abandoned") return known.revokedAt === null ? this.abandonRenewalsNewerThan(known) : false;
 			const reinstated = {
 				...known,
 				revokedAt: null,
@@ -899,6 +899,29 @@ var MeshCertificateRegistry = class {
 		return settled;
 	}
 	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	renewalsInFlight = /* @__PURE__ */ new Set();
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint) {
+		this.renewalsInFlight.add(fingerprint);
+	}
+	endRenewal(fingerprint) {
+		this.renewalsInFlight.delete(fingerprint);
+	}
+	async abandonRenewalsNewerThan(presented) {
+		let changed = false;
+		for (const record of this.liveFor(presented.nodeId)) {
+			if (record.fingerprint === presented.fingerprint) continue;
+			if (record.issuedVia !== "renewal" || record.issuedAt <= presented.issuedAt) continue;
+			if (this.renewalsInFlight.has(record.fingerprint)) continue;
+			if (await this.abandon(record.fingerprint)) changed = true;
+		}
+		return changed;
+	}
 	async abandon(fingerprint) {
 		const record = this.rows.get(fingerprint);
 		if (record === void 0 || record.revokedAt !== null) return false;
@@ -1054,6 +1077,24 @@ function message$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 async function renewMeshCertificate(deps) {
+	const inFlight = { fingerprint: null };
+	try {
+		return await runRenewal(deps, inFlight);
+	} finally {
+		if (inFlight.fingerprint !== null) {
+			deps.registry.endRenewal(inFlight.fingerprint);
+			const live = deps.peers.peerLeaf(deps.nodeId);
+			if (live !== void 0) await deps.registry.recordObserved(deps.nodeId, {
+				cn: deps.nodeId,
+				serial: live.serial,
+				fingerprint: live.fingerprint,
+				notBefore: live.notBefore,
+				notAfter: live.notAfter
+			}).catch(() => void 0);
+		}
+	}
+}
+async function runRenewal(deps, inFlight) {
 	const { nodeId, log } = deps;
 	const tags = { nodeId };
 	const sleep = deps.sleep ?? defaultSleep;
@@ -1115,12 +1156,28 @@ async function renewMeshCertificate(deps) {
 		return fail("issue", message$1(error), true);
 	}
 	const newLeaf = describeMeshLeaf(issued.certPem);
+	deps.registry.beginRenewal(newLeaf.fingerprint);
+	inFlight.fingerprint = newLeaf.fingerprint;
 	let resolveRegistered = () => void 0;
 	const registeredPromise = new Promise((resolve) => {
 		resolveRegistered = resolve;
 	});
-	const unsubscribe = deps.registrations.subscribe((id) => {
-		if (id === nodeId && deps.peers.peerLeaf(nodeId)?.fingerprint === newLeaf.fingerprint) resolveRegistered(true);
+	const expected = deps.expectedAddons?.(nodeId) ?? [];
+	let missingAddons = [];
+	const unsubscribe = deps.registrations.subscribe((id, addonIds) => {
+		if (id !== nodeId || deps.peers.peerLeaf(nodeId)?.fingerprint !== newLeaf.fingerprint) return;
+		if (addonIds !== void 0) {
+			const present = new Set(addonIds);
+			missingAddons = expected.filter((addonId) => !present.has(addonId));
+			if (missingAddons.length > 0) {
+				log.warn("Mesh renewal: the node registered without addons it had before - waiting", {
+					tags,
+					meta: { missing: missingAddons }
+				});
+				return;
+			}
+		}
+		resolveRegistered(true);
 	});
 	const deadlineTimer = setTimer(() => resolveRegistered(false), timeoutMs);
 	registeredPromise.then(() => deadlineTimer.cancel());
@@ -1151,7 +1208,8 @@ async function renewMeshCertificate(deps) {
 			}
 		});
 		await deps.registry.abandon(newLeaf.fingerprint);
-		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s; the previous leaf was kept and is still valid`, true);
+		const lost = missingAddons.length > 0 ? ` (its last registration lacked ${missingAddons.length} addon(s) it had before: ${missingAddons.slice(0, 5).join(", ")}; the swap was rolled back and nothing was revoked - once those addons are running again the next renewal will go through)` : "";
+		return fail("reconnect", `the node was not back and registered with the new leaf within ${Math.round(timeoutMs / 1e3)} s${lost}; the previous leaf was kept and is still valid`, true);
 	}
 	log.info("Mesh renewal: the node registered presenting the new leaf", { tags });
 	let confirmError = "the node did not confirm the new leaf";
@@ -1271,10 +1329,14 @@ function onProcessNodeRegistered(listener) {
 		listeners.delete(listener);
 	};
 }
-/** Called by the hub when a node's `registerNode` has been applied. */
-function emitProcessNodeRegistered(nodeId) {
+/**
+* Called by the hub when a node's `registerNode` has been applied. `addonIds` is what that
+* registration carried (a node's own addons and its children's, D3), so a waiter can tell the
+* registration of a node that came back WHOLE from the first one of a node that lost its children.
+*/
+function emitProcessNodeRegistered(nodeId, addonIds) {
 	for (const listener of [...registrationListeners()]) try {
-		listener(nodeId);
+		listener(nodeId, addonIds);
 	} catch {}
 }
 //#endregion
@@ -87827,6 +87889,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			});
 			server.on("error", (err) => {
 				this.logger.error("Mesh TLS server error.", err);
+				if (this.tlsServer === server) this.tlsServer = null;
 				reject(err);
 			});
 			server.listen({
@@ -87836,9 +87899,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 				const address = server.address();
 				const port = address !== null && typeof address === "object" ? address.port : tlsPort;
 				this.logger.info(`Mesh TLS server is listening on port ${port}`);
+				this.tlsServer = server;
 				resolve();
 			});
-			this.tlsServer = server;
 		});
 	}
 	onTlsClientConnected(socket) {
@@ -88647,4 +88710,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { MESH_AUTH_MODE_FIELD as $, MeshCrl as A, generateMeshKeyPair as B, MESH_NODE_CERTIFICATES_COLLECTION as C, describeMeshLeaf as D, RENEWAL_ABANDONED as E, caFingerprint as F, AGENT_UI_UNLOCK_DOMAIN as G, issueMeshLeafFromCsr as H, caFingerprintCompact as I, UnlockTicketJtiStore as J, AGENT_UI_UNLOCK_TTL_MS as K, createMeshCsrPem as L, MeshCaKeeper as M, getProcessMeshCaState as N, getProcessMeshCertificateRegistry as O, requireProcessMeshCa as P, verifyAgentUiUnlockTicket as Q, exportMeshPrivateKeyPem as R, setProcessMeshTlsListenerState as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, MeshCertificateRegistry as T, loadMeshCa as U, issueMeshLeafForNode as V, AGENT_DASHBOARD_ORIGINS_FIELD as W, mintAgentUiUnlockTicket as X, isAllowedAgentDashboardReturnTo as Y, parseAgentDashboardOrigins as Z, setProcessMeshPeerTransportLookup as _, ServiceBroker as a, setProcessMeshAuthMode as at, getProcessMeshTlsListenerState as b, JoinTokenJtiStore as c, createCidrMatcher as ct, verifyMeshJoinToken as d, readCidrSetting as dt, getProcessMeshAuthMode as et, dropProcessPeer as f, onProcessNodeRegistered as g, getProcessPeerLeaf as h, Errors as i, requestProcessMeshEnforcement as it, processMeshCrl as j, setProcessMeshCertificateRegistry as k, mintMeshJoinToken as l, normalizeIp as lt, getProcessNodeMeshTransport as m, MESH_TLS_PORT_HELLO_FIELD as n, isMeshAuthMode as nt, setProcessMeshTlsEnabler as o, setProcessMeshAuthStatusSource as ot, emitProcessNodeRegistered as p, AGENT_UI_UNLOCK_VERSION as q, TlsTcpTransporter as r, parseMeshAuthMode as rt, enrollMeshNode as s, setProcessMeshEnforcer as st, systemConfigMeshActions as t, getProcessMeshAuthStatus as tt, processJoinTokenJtiStore as u, parseCidrList as ut, renewMeshCertificate as v, MESH_NODE_CERTIFICATES_COLUMNS as w, openMeshTlsWhenRevocationsLoaded as x, revokeMeshCertificate as y, generateMeshCa as z };
+export { verifyAgentUiUnlockTicket as $, setProcessMeshCertificateRegistry as A, generateMeshCa as B, setProcessMeshTlsListenerState as C, RENEWAL_ABANDONED as D, MeshCertificateRegistry as E, requireProcessMeshCa as F, AGENT_DASHBOARD_ORIGINS_FIELD as G, issueMeshLeafForNode as H, caFingerprint as I, AGENT_UI_UNLOCK_VERSION as J, AGENT_UI_UNLOCK_DOMAIN as K, caFingerprintCompact as L, processMeshCrl as M, MeshCaKeeper as N, describeMeshLeaf as O, getProcessMeshCaState as P, parseAgentDashboardOrigins as Q, createMeshCsrPem as R, openMeshTlsWhenRevocationsLoaded as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, MESH_NODE_CERTIFICATES_COLUMNS as T, issueMeshLeafFromCsr as U, generateMeshKeyPair as V, loadMeshCa as W, isAllowedAgentDashboardReturnTo as X, UnlockTicketJtiStore as Y, mintAgentUiUnlockTicket as Z, onProcessNodeRegistered as _, ServiceBroker as a, requestProcessMeshEnforcement as at, revokeMeshCertificate as b, enrollMeshNode as c, setProcessMeshEnforcer as ct, processJoinTokenJtiStore as d, parseCidrList as dt, MESH_AUTH_MODE_FIELD as et, verifyMeshJoinToken as f, readCidrSetting as ft, getProcessPeerLeaf as g, getProcessNodeMeshTransport as h, Errors as i, parseMeshAuthMode as it, MeshCrl as j, getProcessMeshCertificateRegistry as k, JoinTokenJtiStore as l, createCidrMatcher as lt, emitProcessNodeRegistered as m, MESH_TLS_PORT_HELLO_FIELD as n, getProcessMeshAuthStatus as nt, Transporters as o, setProcessMeshAuthMode as ot, dropProcessPeer as p, AGENT_UI_UNLOCK_TTL_MS as q, TlsTcpTransporter as r, isMeshAuthMode as rt, setProcessMeshTlsEnabler as s, setProcessMeshAuthStatusSource as st, systemConfigMeshActions as t, getProcessMeshAuthMode as tt, mintMeshJoinToken as u, normalizeIp as ut, setProcessMeshPeerTransportLookup as v, MESH_NODE_CERTIFICATES_COLLECTION as w, getProcessMeshTlsListenerState as x, renewMeshCertificate as y, exportMeshPrivateKeyPem as z };

package/dist/index.js

@@ -15054,7 +15054,7 @@ function resolveUseHostname() {
 	return process.env["CAMSTACK_MOLECULER_USE_HOSTNAME"] !== "false";
 }
 function createBroker(config) {
-	const { nodeID, mode, hubAddress, logLevel = "warn", tcpPort = DEFAULT_HUB_TCP_PORT } = config;
+	const { nodeID, mode, logLevel = "warn", tcpPort = DEFAULT_HUB_TCP_PORT } = config;
 	const useHostname = resolveUseHostname();
 	const infraLevel = "error";
 	const wildcardLevel = logLevel;
@@ -15101,56 +15101,11 @@ function createBroker(config) {
 		},
 		metrics: metricsConfig
 	});
-	const agentListenPort = config.agentListenPort ?? deriveAgentListenPort(nodeID);
-	const hasMeshTls = config.meshTls !== void 0;
-	const hubDialPort = hasMeshTls ? config.tlsPort ?? 6443 : tcpPort;
-	if (hasMeshTls) {
-		const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
-		return new require_builtins_system_config_system_config_addon.ServiceBroker({
-			nodeID,
-			serializer: "MsgPack",
-			transporter: new require_builtins_system_config_system_config_addon.TlsTcpTransporter({
-				port: agentListenPort,
-				tlsPort: config.agentTlsListenPort ?? 6443,
-				peerTlsPort: hubDialPort,
-				hubOnlyPeers: true,
-				maxPacketSize: 10 * 1024 * 1024,
-				useHostname,
-				debug: false,
-				meshTls: config.meshTls,
-				udpDiscovery: false,
-				...urls !== void 0 ? { urls } : {}
-			}),
-			...config.middlewares !== void 0 ? { middlewares: [...config.middlewares] } : {},
-			logger: {
-				type: "Console",
-				options: { level: {
-					BROKER: infraLevel,
-					TRANSPORTER: infraLevel,
-					TRANSIT: infraLevel,
-					REGISTRY: infraLevel,
-					DISCOVERER: infraLevel,
-					"**": wildcardLevel
-				} }
-			},
-			metrics: metricsConfig
-		});
-	}
-	const tcpOptions = {
-		maxPacketSize: 10 * 1024 * 1024,
-		port: agentListenPort,
-		useHostname,
-		debug: false
-	};
-	tcpOptions.udpDiscovery = false;
-	if (hubAddress) tcpOptions.urls = normalizeHubUrl(hubAddress, tcpPort);
+	const transport = createAgentTransport(config);
 	return new require_builtins_system_config_system_config_addon.ServiceBroker({
 		nodeID,
 		serializer: "MsgPack",
-		transporter: {
-			type: "TCP",
-			options: tcpOptions
-		},
+		transporter: transport.kind === "tls" ? transport.transporter : transport.descriptor,
 		...config.middlewares !== void 0 ? { middlewares: [...config.middlewares] } : {},
 		logger: {
 			type: "Console",
@@ -15166,6 +15121,58 @@ function createBroker(config) {
 		metrics: metricsConfig
 	});
 }
+/**
+* The transport of an agent broker, from its config. An agent with no hub address dials nobody
+* and stays `unconfigured` until one is set (the agent UI lists the hubs found over mDNS, D839).
+* There is no UDP discovery to fall back on (D843).
+*
+* The reader binds a STABLE port derived from the nodeID (not an OS-ephemeral `port: 0`). See
+* `deriveAgentListenPort` - this is what makes a same-nodeID kill+restart reconnect cleanly:
+* Moleculer never refreshes a known node's address, so the agent must return at the same address
+* it left from.
+*
+* Shared by `createBroker` (the first transport) and the in-place reconnect
+* (`broker-transport-swap.ts`, the next one): one builder, so a reconnect cannot dial differently
+* from a boot.
+*/
+function createAgentTransport(config) {
+	const { nodeID, hubAddress, tcpPort = DEFAULT_HUB_TCP_PORT } = config;
+	const useHostname = resolveUseHostname();
+	const agentListenPort = config.agentListenPort ?? deriveAgentListenPort(nodeID);
+	const hubDialPort = config.meshTls !== void 0 ? config.tlsPort ?? 6443 : tcpPort;
+	if (config.meshTls !== void 0) {
+		const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
+		return {
+			kind: "tls",
+			transporter: new require_builtins_system_config_system_config_addon.TlsTcpTransporter({
+				port: agentListenPort,
+				tlsPort: config.agentTlsListenPort ?? 6443,
+				peerTlsPort: hubDialPort,
+				hubOnlyPeers: true,
+				maxPacketSize: 10 * 1024 * 1024,
+				useHostname,
+				debug: false,
+				meshTls: config.meshTls,
+				udpDiscovery: false,
+				...urls !== void 0 ? { urls } : {}
+			})
+		};
+	}
+	return {
+		kind: "tcp",
+		descriptor: {
+			type: "TCP",
+			options: {
+				maxPacketSize: 10 * 1024 * 1024,
+				port: agentListenPort,
+				useHostname,
+				debug: false,
+				udpDiscovery: false,
+				...hubAddress ? { urls: normalizeHubUrl(hubAddress, tcpPort) } : {}
+			}
+		}
+	};
+}
 function normalizeHubUrl(raw, defaultPort) {
 	const atSplit = raw.includes("@") ? raw.split("@") : null;
 	const nodeIdFromAt = atSplit ? atSplit[0] : null;
@@ -15181,6 +15188,142 @@ function getBrokerTlsTransporter(broker) {
 	return tx instanceof require_builtins_system_config_system_config_addon.TlsTcpTransporter ? tx : null;
 }
 //#endregion
+//#region src/kernel/moleculer/broker-transport-swap.ts
+/**
+* Reconnecting a broker's TRANSPORT in place, without rebuilding the broker (D856 amendment).
+*
+* An agent changes how it dials the hub (a new hub address, a new cluster secret, a mesh leaf
+* swap or its rollback) by replacing its transporter. It used to stop the whole `ServiceBroker`
+* and build another. That threw away everything bound to the old one: the `$process` service
+* (whose `stopped()` SIGTERMs every runner - the "child gone" lines), `$agent-cap-fwd`,
+* `$agent`, the event bus, the addon services and every closure that captured the broker. The
+* node came back ONLINE and capless, and the hub's confirm step then failed with
+* "`$agent-cap-fwd.forward` is not found".
+*
+* The broker, its services, its registries and its child runners are all independent of the
+* wire. So only the wire is replaced: disconnect the transit, forget the remote nodes (their
+* connection is gone, and the next `$node.connected` is what re-runs the mesh join), install a
+* new transporter on the SAME transit and connect it. Children never notice; the join's settle
+* re-sends the full manifest (D3), which still carries every child.
+*/
+function isObject(value) {
+	return typeof value === "object" && value !== null;
+}
+function isFunction(value) {
+	return typeof value === "function";
+}
+/** Moleculer's d.ts hides the transit and the registry internals: check them at runtime instead. */
+function isWrappingBroker(value) {
+	return isObject(value) && isFunction(Reflect.get(value, "wrapMethod")) && hasNodeCatalog(Reflect.get(value, "registry")) && "transit" in value;
+}
+/** The node catalog the swap forgets remote nodes through (private Moleculer API, pinned by a spec). */
+function hasNodeCatalog(registry) {
+	if (!isObject(registry)) return false;
+	const nodes = Reflect.get(registry, "nodes");
+	return isObject(nodes) && isFunction(Reflect.get(nodes, "disconnected")) && isFunction(Reflect.get(nodes, "list"));
+}
+function isTransporterLike(value) {
+	return isObject(value) && isFunction(Reflect.get(value, "init")) && isFunction(Reflect.get(value, "connect")) && isFunction(Reflect.get(value, "disconnect"));
+}
+function wrapping(broker) {
+	if (!isWrappingBroker(broker)) throw new Error("not a Moleculer broker with a transport");
+	return broker;
+}
+function transitOf(broker) {
+	const transit = wrapping(broker).transit;
+	if (transit === null || transit === void 0) throw new Error("the broker has no transport to reconnect");
+	return transit;
+}
+/** The transporter currently installed on the broker (for identity checks). */
+function currentBrokerTransporter(broker) {
+	return { tx: transitOf(broker).tx };
+}
+/** Build the transporter an {@link AgentTransport} describes (nothing is bound or dialled yet). */
+function buildTransporter(transport) {
+	const tx = transport.kind === "tls" ? transport.transporter : require_builtins_system_config_system_config_addon.Transporters.resolve(transport.descriptor);
+	if (!isTransporterLike(tx)) throw new Error("the agent transport is not a Moleculer transporter");
+	return { tx };
+}
+/**
+* Whether `pending` is the transporter installed on the broker right now. A reconnect that was
+* abandoned at its deadline and resumes later must not tear down a newer run's transport.
+*/
+function isInstalledTransporter(broker, pending) {
+	return transitOf(broker).tx === pending.tx;
+}
+/**
+* Disconnect the installed transporter and forget every remote node. Forgetting is what makes the
+* hub's next INFO a NEW connection: `$node.connected` fires again, so the agent's mesh join re-runs
+* and its settle re-sends the manifest. Without it the hub would still be "available" in the local
+* registry and nothing would re-announce the node.
+*/
+async function disconnectBrokerTransport(broker) {
+	const b = wrapping(broker);
+	const transit = transitOf(broker);
+	const leaving = transit.tx;
+	retired.add(leaving);
+	try {
+		await transit.disconnect();
+	} finally {
+		detachListeners(leaving);
+		for (const node of b.registry.nodes.list({ onlyAvailable: true })) if (node.id !== b.nodeID) b.registry.nodes.disconnected(node.id, false);
+	}
+}
+/** Transporters that were disconnected or replaced: their `connect` is a no-op for good. */
+var retired = /* @__PURE__ */ new WeakSet();
+/**
+* The leaving transporter's writer must not keep reporting into the SHARED node catalog: a late
+* FIN on one of its sockets would call `nodes.disconnected` on the node the NEW transporter just
+* connected to.
+*/
+function detachListeners(tx) {
+	for (const emitter of [tx.writer, tx.reader]) if (isObject(emitter) && isFunction(Reflect.get(emitter, "removeAllListeners"))) Reflect.get(emitter, "removeAllListeners").call(emitter);
+}
+/**
+* One connect at a time per transporter, and none for a retired or replaced one. Moleculer's connect
+* retry re-runs `tx.connect()` on whatever `transit.tx` is when its timer fires; a second run of
+* `startTcpServer` overwrites the live reader and writer, leaks the gossip interval and leaves a
+* listening server behind. A connect that fails is cleaned up before the retry runs.
+*/
+function guardConnect(transit, tx) {
+	const original = tx.connect.bind(tx);
+	let inflight = null;
+	tx.connect = (...args) => {
+		if (retired.has(tx) || transit.tx !== tx) return Promise.resolve();
+		if (inflight !== null) return inflight;
+		if (tx.connected === true) return Promise.resolve();
+		const run = original(...args).catch(async (error) => {
+			await Promise.resolve(tx.disconnect()).catch(() => void 0);
+			throw error;
+		}).finally(() => {
+			if (inflight === run) inflight = null;
+		});
+		inflight = run;
+		return run;
+	};
+}
+/**
+* Install `pending` as the broker's transporter: the same wiring Moleculer's `Transit` constructor
+* does (init + the broker's send/receive middleware wrapping, which carries the mesh join gate).
+*/
+function installBrokerTransporter(broker, pending) {
+	const b = wrapping(broker);
+	const transit = transitOf(broker);
+	const tx = pending.tx;
+	retired.add(transit.tx);
+	guardConnect(transit, tx);
+	tx.init(transit, (cmd, packet) => transit.messageHandler(cmd, packet), transit.afterConnect.bind(transit));
+	const send = b.wrapMethod("transporterSend", tx.send, tx);
+	const receive = b.wrapMethod("transporterReceive", tx.receive, tx, { reverse: true });
+	tx.send = send;
+	tx.receive = receive;
+	transit.tx = tx;
+}
+/** Connect the installed transporter (the broker's own `start()` path, minus the services). */
+async function connectBrokerTransport(broker) {
+	await transitOf(broker).connect();
+}
+//#endregion
 //#region src/kernel/moleculer/addon-deploy-source.ts
 function isAddonDeploySource(v) {
 	if (!v || typeof v !== "object") return false;
@@ -27144,6 +27287,7 @@ exports.buildNativeCapProxy = buildNativeCapProxy;
 exports.buildNodeManifest = buildNodeManifest;
 exports.buildNpmChildEnv = buildNpmChildEnv;
 exports.buildStorageLocationRegistry = require_builtins_storage_orchestrator_storage_orchestrator_addon.buildStorageLocationRegistry;
+exports.buildTransporter = buildTransporter;
 exports.builderMountedCapNames = builderMountedCapNames;
 exports.caFingerprint = require_builtins_system_config_system_config_addon.caFingerprint;
 exports.caFingerprintCompact = require_builtins_system_config_system_config_addon.caFingerprintCompact;
@@ -27170,6 +27314,7 @@ exports.collectCertIdentity = require_tls.collectCertIdentity;
 exports.collectModelFiles = require_custom_action_registry.collectModelFiles;
 exports.computeHubJoinProof = computeHubJoinProof;
 exports.computeNodeJoinProof = computeNodeJoinProof;
+exports.connectBrokerTransport = connectBrokerTransport;
 exports.contentTypeFor = require_custom_action_registry.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
 exports.copyExtraFileDirs = copyExtraFileDirs;
@@ -27179,6 +27324,7 @@ exports.createAddonPeerBytesFacility = createAddonPeerBytesFacility;
 exports.createAddonService = createAddonService;
 exports.createAgentEventScope = createAgentEventScope;
 exports.createAgentHttpsRequest = require_tls.createAgentHttpsRequest;
+exports.createAgentTransport = createAgentTransport;
 exports.createArrayBufferCensusGate = createArrayBufferCensusGate;
 exports.createAuthenticatedFileServer = require_custom_action_registry.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
@@ -27217,6 +27363,7 @@ exports.createUdsEventBus = createUdsEventBus;
 exports.createUdsLogger = createUdsLogger;
 exports.createUdsLoggerWithControl = createUdsLoggerWithControl;
 exports.createV8Reclaimer = createV8Reclaimer;
+exports.currentBrokerTransporter = currentBrokerTransporter;
 exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
 exports.deleteModelFromDisk = require_custom_action_registry.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
@@ -27230,6 +27377,7 @@ exports.deviceOfGetStatus = deviceOfGetStatus;
 exports.diffCapActionCensus = diffCapActionCensus;
 exports.diffEventPlane = diffEventPlane;
 exports.diffSocketPlane = diffSocketPlane;
+exports.disconnectBrokerTransport = disconnectBrokerTransport;
 Object.defineProperty(exports, "downloadBinary", {
 	enumerable: true,
 	get: function() {
@@ -27337,6 +27485,7 @@ exports.heapSpaceField = heapSpaceField;
 exports.hostNodeIdOf = hostNodeIdOf;
 exports.hubMainRssBudget = hubMainRssBudget;
 exports.installAgentHttps = require_tls.installAgentHttps;
+exports.installBrokerTransporter = installBrokerTransporter;
 exports.installManifestNativeDeps = installManifestNativeDeps;
 exports.installManifestPythonDeps = installManifestPythonDeps;
 exports.installManifestSystemDeps = installManifestSystemDeps;
@@ -27363,6 +27512,7 @@ exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isContainerBridgeAddress = require_tls.isContainerBridgeAddress;
 exports.isCredentialKeyName = isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
+exports.isInstalledTransporter = isInstalledTransporter;
 exports.isLocalOnlyHostname = require_tls.isLocalOnlyHostname;
 exports.isMeshAuthMode = require_builtins_system_config_system_config_addon.isMeshAuthMode;
 exports.isModelDownloaded = require_custom_action_registry.isModelDownloaded;

package/dist/index.mjs

@@ -28,7 +28,7 @@ import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapF
 import "./builtins/storage-orchestrator/index.mjs";
 import { a as setProcessAgentHttpsNames, i as getProcessAgentHttpsNames, n as AGENT_HTTPS_NAMES_COLUMNS, r as AgentHttpsNames, t as AGENT_HTTPS_NAMES_COLLECTION } from "./agent-https-names-uetr4OQl.mjs";
 import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CttE77VF.mjs";
-import { $ as MESH_AUTH_MODE_FIELD, A as MeshCrl, B as generateMeshKeyPair, C as MESH_NODE_CERTIFICATES_COLLECTION, D as describeMeshLeaf, E as RENEWAL_ABANDONED, F as caFingerprint, G as AGENT_UI_UNLOCK_DOMAIN, H as issueMeshLeafFromCsr, I as caFingerprintCompact, J as UnlockTicketJtiStore, K as AGENT_UI_UNLOCK_TTL_MS, L as createMeshCsrPem, M as MeshCaKeeper, N as getProcessMeshCaState, O as getProcessMeshCertificateRegistry, P as requireProcessMeshCa, Q as verifyAgentUiUnlockTicket, R as exportMeshPrivateKeyPem, S as setProcessMeshTlsListenerState, SystemConfigAddon, T as MeshCertificateRegistry, U as loadMeshCa, V as issueMeshLeafForNode, W as AGENT_DASHBOARD_ORIGINS_FIELD, X as mintAgentUiUnlockTicket, Y as isAllowedAgentDashboardReturnTo, Z as parseAgentDashboardOrigins, _ as setProcessMeshPeerTransportLookup, a as ServiceBroker, at as setProcessMeshAuthMode, b as getProcessMeshTlsListenerState, c as JoinTokenJtiStore, ct as createCidrMatcher, d as verifyMeshJoinToken, dt as readCidrSetting, et as getProcessMeshAuthMode, f as dropProcessPeer, g as onProcessNodeRegistered, h as getProcessPeerLeaf, i as Errors, it as requestProcessMeshEnforcement, j as processMeshCrl, k as setProcessMeshCertificateRegistry, l as mintMeshJoinToken, lt as normalizeIp, m as getProcessNodeMeshTransport, n as MESH_TLS_PORT_HELLO_FIELD, nt as isMeshAuthMode, o as setProcessMeshTlsEnabler, ot as setProcessMeshAuthStatusSource, p as emitProcessNodeRegistered, q as AGENT_UI_UNLOCK_VERSION, r as TlsTcpTransporter, rt as parseMeshAuthMode, s as enrollMeshNode, st as setProcessMeshEnforcer, tt as getProcessMeshAuthStatus, u as processJoinTokenJtiStore, ut as parseCidrList, v as renewMeshCertificate, w as MESH_NODE_CERTIFICATES_COLUMNS, x as openMeshTlsWhenRevocationsLoaded, y as revokeMeshCertificate, z as generateMeshCa } from "./builtins/system-config/system-config.addon.mjs";
+import { $ as verifyAgentUiUnlockTicket, A as setProcessMeshCertificateRegistry, B as generateMeshCa, C as setProcessMeshTlsListenerState, D as RENEWAL_ABANDONED, E as MeshCertificateRegistry, F as requireProcessMeshCa, G as AGENT_DASHBOARD_ORIGINS_FIELD, H as issueMeshLeafForNode, I as caFingerprint, J as AGENT_UI_UNLOCK_VERSION, K as AGENT_UI_UNLOCK_DOMAIN, L as caFingerprintCompact, M as processMeshCrl, N as MeshCaKeeper, O as describeMeshLeaf, P as getProcessMeshCaState, Q as parseAgentDashboardOrigins, R as createMeshCsrPem, S as openMeshTlsWhenRevocationsLoaded, SystemConfigAddon, T as MESH_NODE_CERTIFICATES_COLUMNS, U as issueMeshLeafFromCsr, V as generateMeshKeyPair, W as loadMeshCa, X as isAllowedAgentDashboardReturnTo, Y as UnlockTicketJtiStore, Z as mintAgentUiUnlockTicket, _ as onProcessNodeRegistered, a as ServiceBroker, at as requestProcessMeshEnforcement, b as revokeMeshCertificate, c as enrollMeshNode, ct as setProcessMeshEnforcer, d as processJoinTokenJtiStore, dt as parseCidrList, et as MESH_AUTH_MODE_FIELD, f as verifyMeshJoinToken, ft as readCidrSetting, g as getProcessPeerLeaf, h as getProcessNodeMeshTransport, i as Errors, it as parseMeshAuthMode, j as MeshCrl, k as getProcessMeshCertificateRegistry, l as JoinTokenJtiStore, lt as createCidrMatcher, m as emitProcessNodeRegistered, n as MESH_TLS_PORT_HELLO_FIELD, nt as getProcessMeshAuthStatus, o as Transporters, ot as setProcessMeshAuthMode, p as dropProcessPeer, q as AGENT_UI_UNLOCK_TTL_MS, r as TlsTcpTransporter, rt as isMeshAuthMode, s as setProcessMeshTlsEnabler, st as setProcessMeshAuthStatusSource, tt as getProcessMeshAuthMode, u as mintMeshJoinToken, ut as normalizeIp, v as setProcessMeshPeerTransportLookup, w as MESH_NODE_CERTIFICATES_COLLECTION, x as getProcessMeshTlsListenerState, y as renewMeshCertificate, z as exportMeshPrivateKeyPem } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
@@ -15051,7 +15051,7 @@ function resolveUseHostname() {
 	return process.env["CAMSTACK_MOLECULER_USE_HOSTNAME"] !== "false";
 }
 function createBroker(config) {
-	const { nodeID, mode, hubAddress, logLevel = "warn", tcpPort = DEFAULT_HUB_TCP_PORT } = config;
+	const { nodeID, mode, logLevel = "warn", tcpPort = DEFAULT_HUB_TCP_PORT } = config;
 	const useHostname = resolveUseHostname();
 	const infraLevel = "error";
 	const wildcardLevel = logLevel;
@@ -15098,56 +15098,11 @@ function createBroker(config) {
 		},
 		metrics: metricsConfig
 	});
-	const agentListenPort = config.agentListenPort ?? deriveAgentListenPort(nodeID);
-	const hasMeshTls = config.meshTls !== void 0;
-	const hubDialPort = hasMeshTls ? config.tlsPort ?? 6443 : tcpPort;
-	if (hasMeshTls) {
-		const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
-		return new ServiceBroker({
-			nodeID,
-			serializer: "MsgPack",
-			transporter: new TlsTcpTransporter({
-				port: agentListenPort,
-				tlsPort: config.agentTlsListenPort ?? 6443,
-				peerTlsPort: hubDialPort,
-				hubOnlyPeers: true,
-				maxPacketSize: 10 * 1024 * 1024,
-				useHostname,
-				debug: false,
-				meshTls: config.meshTls,
-				udpDiscovery: false,
-				...urls !== void 0 ? { urls } : {}
-			}),
-			...config.middlewares !== void 0 ? { middlewares: [...config.middlewares] } : {},
-			logger: {
-				type: "Console",
-				options: { level: {
-					BROKER: infraLevel,
-					TRANSPORTER: infraLevel,
-					TRANSIT: infraLevel,
-					REGISTRY: infraLevel,
-					DISCOVERER: infraLevel,
-					"**": wildcardLevel
-				} }
-			},
-			metrics: metricsConfig
-		});
-	}
-	const tcpOptions = {
-		maxPacketSize: 10 * 1024 * 1024,
-		port: agentListenPort,
-		useHostname,
-		debug: false
-	};
-	tcpOptions.udpDiscovery = false;
-	if (hubAddress) tcpOptions.urls = normalizeHubUrl(hubAddress, tcpPort);
+	const transport = createAgentTransport(config);
 	return new ServiceBroker({
 		nodeID,
 		serializer: "MsgPack",
-		transporter: {
-			type: "TCP",
-			options: tcpOptions
-		},
+		transporter: transport.kind === "tls" ? transport.transporter : transport.descriptor,
 		...config.middlewares !== void 0 ? { middlewares: [...config.middlewares] } : {},
 		logger: {
 			type: "Console",
@@ -15163,6 +15118,58 @@ function createBroker(config) {
 		metrics: metricsConfig
 	});
 }
+/**
+* The transport of an agent broker, from its config. An agent with no hub address dials nobody
+* and stays `unconfigured` until one is set (the agent UI lists the hubs found over mDNS, D839).
+* There is no UDP discovery to fall back on (D843).
+*
+* The reader binds a STABLE port derived from the nodeID (not an OS-ephemeral `port: 0`). See
+* `deriveAgentListenPort` - this is what makes a same-nodeID kill+restart reconnect cleanly:
+* Moleculer never refreshes a known node's address, so the agent must return at the same address
+* it left from.
+*
+* Shared by `createBroker` (the first transport) and the in-place reconnect
+* (`broker-transport-swap.ts`, the next one): one builder, so a reconnect cannot dial differently
+* from a boot.
+*/
+function createAgentTransport(config) {
+	const { nodeID, hubAddress, tcpPort = DEFAULT_HUB_TCP_PORT } = config;
+	const useHostname = resolveUseHostname();
+	const agentListenPort = config.agentListenPort ?? deriveAgentListenPort(nodeID);
+	const hubDialPort = config.meshTls !== void 0 ? config.tlsPort ?? 6443 : tcpPort;
+	if (config.meshTls !== void 0) {
+		const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
+		return {
+			kind: "tls",
+			transporter: new TlsTcpTransporter({
+				port: agentListenPort,
+				tlsPort: config.agentTlsListenPort ?? 6443,
+				peerTlsPort: hubDialPort,
+				hubOnlyPeers: true,
+				maxPacketSize: 10 * 1024 * 1024,
+				useHostname,
+				debug: false,
+				meshTls: config.meshTls,
+				udpDiscovery: false,
+				...urls !== void 0 ? { urls } : {}
+			})
+		};
+	}
+	return {
+		kind: "tcp",
+		descriptor: {
+			type: "TCP",
+			options: {
+				maxPacketSize: 10 * 1024 * 1024,
+				port: agentListenPort,
+				useHostname,
+				debug: false,
+				udpDiscovery: false,
+				...hubAddress ? { urls: normalizeHubUrl(hubAddress, tcpPort) } : {}
+			}
+		}
+	};
+}
 function normalizeHubUrl(raw, defaultPort) {
 	const atSplit = raw.includes("@") ? raw.split("@") : null;
 	const nodeIdFromAt = atSplit ? atSplit[0] : null;
@@ -15178,6 +15185,142 @@ function getBrokerTlsTransporter(broker) {
 	return tx instanceof TlsTcpTransporter ? tx : null;
 }
 //#endregion
+//#region src/kernel/moleculer/broker-transport-swap.ts
+/**
+* Reconnecting a broker's TRANSPORT in place, without rebuilding the broker (D856 amendment).
+*
+* An agent changes how it dials the hub (a new hub address, a new cluster secret, a mesh leaf
+* swap or its rollback) by replacing its transporter. It used to stop the whole `ServiceBroker`
+* and build another. That threw away everything bound to the old one: the `$process` service
+* (whose `stopped()` SIGTERMs every runner - the "child gone" lines), `$agent-cap-fwd`,
+* `$agent`, the event bus, the addon services and every closure that captured the broker. The
+* node came back ONLINE and capless, and the hub's confirm step then failed with
+* "`$agent-cap-fwd.forward` is not found".
+*
+* The broker, its services, its registries and its child runners are all independent of the
+* wire. So only the wire is replaced: disconnect the transit, forget the remote nodes (their
+* connection is gone, and the next `$node.connected` is what re-runs the mesh join), install a
+* new transporter on the SAME transit and connect it. Children never notice; the join's settle
+* re-sends the full manifest (D3), which still carries every child.
+*/
+function isObject(value) {
+	return typeof value === "object" && value !== null;
+}
+function isFunction(value) {
+	return typeof value === "function";
+}
+/** Moleculer's d.ts hides the transit and the registry internals: check them at runtime instead. */
+function isWrappingBroker(value) {
+	return isObject(value) && isFunction(Reflect.get(value, "wrapMethod")) && hasNodeCatalog(Reflect.get(value, "registry")) && "transit" in value;
+}
+/** The node catalog the swap forgets remote nodes through (private Moleculer API, pinned by a spec). */
+function hasNodeCatalog(registry) {
+	if (!isObject(registry)) return false;
+	const nodes = Reflect.get(registry, "nodes");
+	return isObject(nodes) && isFunction(Reflect.get(nodes, "disconnected")) && isFunction(Reflect.get(nodes, "list"));
+}
+function isTransporterLike(value) {
+	return isObject(value) && isFunction(Reflect.get(value, "init")) && isFunction(Reflect.get(value, "connect")) && isFunction(Reflect.get(value, "disconnect"));
+}
+function wrapping(broker) {
+	if (!isWrappingBroker(broker)) throw new Error("not a Moleculer broker with a transport");
+	return broker;
+}
+function transitOf(broker) {
+	const transit = wrapping(broker).transit;
+	if (transit === null || transit === void 0) throw new Error("the broker has no transport to reconnect");
+	return transit;
+}
+/** The transporter currently installed on the broker (for identity checks). */
+function currentBrokerTransporter(broker) {
+	return { tx: transitOf(broker).tx };
+}
+/** Build the transporter an {@link AgentTransport} describes (nothing is bound or dialled yet). */
+function buildTransporter(transport) {
+	const tx = transport.kind === "tls" ? transport.transporter : Transporters.resolve(transport.descriptor);
+	if (!isTransporterLike(tx)) throw new Error("the agent transport is not a Moleculer transporter");
+	return { tx };
+}
+/**
+* Whether `pending` is the transporter installed on the broker right now. A reconnect that was
+* abandoned at its deadline and resumes later must not tear down a newer run's transport.
+*/
+function isInstalledTransporter(broker, pending) {
+	return transitOf(broker).tx === pending.tx;
+}
+/**
+* Disconnect the installed transporter and forget every remote node. Forgetting is what makes the
+* hub's next INFO a NEW connection: `$node.connected` fires again, so the agent's mesh join re-runs
+* and its settle re-sends the manifest. Without it the hub would still be "available" in the local
+* registry and nothing would re-announce the node.
+*/
+async function disconnectBrokerTransport(broker) {
+	const b = wrapping(broker);
+	const transit = transitOf(broker);
+	const leaving = transit.tx;
+	retired.add(leaving);
+	try {
+		await transit.disconnect();
+	} finally {
+		detachListeners(leaving);
+		for (const node of b.registry.nodes.list({ onlyAvailable: true })) if (node.id !== b.nodeID) b.registry.nodes.disconnected(node.id, false);
+	}
+}
+/** Transporters that were disconnected or replaced: their `connect` is a no-op for good. */
+var retired = /* @__PURE__ */ new WeakSet();
+/**
+* The leaving transporter's writer must not keep reporting into the SHARED node catalog: a late
+* FIN on one of its sockets would call `nodes.disconnected` on the node the NEW transporter just
+* connected to.
+*/
+function detachListeners(tx) {
+	for (const emitter of [tx.writer, tx.reader]) if (isObject(emitter) && isFunction(Reflect.get(emitter, "removeAllListeners"))) Reflect.get(emitter, "removeAllListeners").call(emitter);
+}
+/**
+* One connect at a time per transporter, and none for a retired or replaced one. Moleculer's connect
+* retry re-runs `tx.connect()` on whatever `transit.tx` is when its timer fires; a second run of
+* `startTcpServer` overwrites the live reader and writer, leaks the gossip interval and leaves a
+* listening server behind. A connect that fails is cleaned up before the retry runs.
+*/
+function guardConnect(transit, tx) {
+	const original = tx.connect.bind(tx);
+	let inflight = null;
+	tx.connect = (...args) => {
+		if (retired.has(tx) || transit.tx !== tx) return Promise.resolve();
+		if (inflight !== null) return inflight;
+		if (tx.connected === true) return Promise.resolve();
+		const run = original(...args).catch(async (error) => {
+			await Promise.resolve(tx.disconnect()).catch(() => void 0);
+			throw error;
+		}).finally(() => {
+			if (inflight === run) inflight = null;
+		});
+		inflight = run;
+		return run;
+	};
+}
+/**
+* Install `pending` as the broker's transporter: the same wiring Moleculer's `Transit` constructor
+* does (init + the broker's send/receive middleware wrapping, which carries the mesh join gate).
+*/
+function installBrokerTransporter(broker, pending) {
+	const b = wrapping(broker);
+	const transit = transitOf(broker);
+	const tx = pending.tx;
+	retired.add(transit.tx);
+	guardConnect(transit, tx);
+	tx.init(transit, (cmd, packet) => transit.messageHandler(cmd, packet), transit.afterConnect.bind(transit));
+	const send = b.wrapMethod("transporterSend", tx.send, tx);
+	const receive = b.wrapMethod("transporterReceive", tx.receive, tx, { reverse: true });
+	tx.send = send;
+	tx.receive = receive;
+	transit.tx = tx;
+}
+/** Connect the installed transporter (the broker's own `start()` path, minus the services). */
+async function connectBrokerTransport(broker) {
+	await transitOf(broker).connect();
+}
+//#endregion
 //#region src/kernel/moleculer/addon-deploy-source.ts
 function isAddonDeploySource(v) {
 	if (!v || typeof v !== "object") return false;
@@ -26885,4 +27028,4 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectAgentNames, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installAgentHttps, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isLocalOnlyHostname, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isPrivateAddress, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshCertificateRegistry, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectAgentNames, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isPrivateAddress, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshCertificateRegistry, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -37,8 +37,10 @@ export type { AddonSettingsView } from "./config-manager.js";
 export { DeviceRegistry } from "./device-registry.js";
 export { buildStorageLocationRegistry } from "./storage-location-registry.js";
 export type { StorageLocationRegistry } from "./storage-location-registry.js";
-export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter } from "./moleculer/broker-factory.js";
-export type { BrokerConfig } from "./moleculer/broker-factory.js";
+export { createAgentTransport, createBroker, deriveAgentListenPort, getBrokerTlsTransporter } from "./moleculer/broker-factory.js";
+export type { AgentTransport, BrokerConfig } from "./moleculer/broker-factory.js";
+export { buildTransporter, connectBrokerTransport, currentBrokerTransporter, disconnectBrokerTransport, installBrokerTransporter, isInstalledTransporter } from "./moleculer/broker-transport-swap.js";
+export type { PendingTransporter } from "./moleculer/broker-transport-swap.js";
 export { caFingerprint, caFingerprintCompact, describeMeshLeaf, dropProcessPeer, emitProcessNodeRegistered, onProcessNodeRegistered, getProcessMeshCertificateRegistry, getProcessPeerLeaf, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, getProcessMeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, RENEWAL_ABANDONED, setProcessMeshTlsListenerState, renewMeshCertificate, revokeMeshCertificate, setProcessMeshCertificateRegistry, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
 export type { MeshCertificateRecord, MeshLeafDescription, MeshLog, MeshPeerLeaf, MeshPeers, MeshRegistrations, MeshTlsListenerState, NodeMeshClient, RenewMeshResult, RevokeMeshResult, MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
 export { type AddonDeploySource, isAddonDeploySource } from "./moleculer/addon-deploy-source.js";

package/dist/kernel/moleculer/broker-factory.d.ts

@@ -68,8 +68,34 @@ interface BrokerConfig {
 */
 declare function deriveAgentListenPort(nodeID: string): number;
 declare function createBroker(config: BrokerConfig): ServiceBroker;
+/** What an agent's transport is made of: an mTLS transporter, or the clear TCP descriptor. */
+type AgentTransport = {
+	readonly kind: "tls";
+	readonly transporter: TlsTcpTransporter;
+} | {
+	readonly kind: "tcp";
+	readonly descriptor: {
+		readonly type: "TCP";
+		readonly options: Record<string, unknown>;
+	};
+};
+/**
+* The transport of an agent broker, from its config. An agent with no hub address dials nobody
+* and stays `unconfigured` until one is set (the agent UI lists the hubs found over mDNS, D839).
+* There is no UDP discovery to fall back on (D843).
+*
+* The reader binds a STABLE port derived from the nodeID (not an OS-ephemeral `port: 0`). See
+* `deriveAgentListenPort` - this is what makes a same-nodeID kill+restart reconnect cleanly:
+* Moleculer never refreshes a known node's address, so the agent must return at the same address
+* it left from.
+*
+* Shared by `createBroker` (the first transport) and the in-place reconnect
+* (`broker-transport-swap.ts`, the next one): one builder, so a reconnect cannot dial differently
+* from a boot.
+*/
+declare function createAgentTransport(config: BrokerConfig): AgentTransport;
 declare function normalizeHubUrl(raw: string, defaultPort: number): string;
 /** The hub's {@link TlsTcpTransporter}, or null when the broker is not mesh-TLS. */
 declare function getBrokerTlsTransporter(broker: ServiceBroker): TlsTcpTransporter | null;
-export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter, normalizeHubUrl };
-export type { BrokerConfig };
+export { createAgentTransport, createBroker, deriveAgentListenPort, getBrokerTlsTransporter, normalizeHubUrl };
+export type { AgentTransport, BrokerConfig };

package/dist/kernel/moleculer/broker-transport-swap.d.ts

@@ -0,0 +1,43 @@
+import type { AgentTransport } from "./broker-factory.js";
+/** The slice of a Moleculer transporter this module drives. */
+interface TransporterLike {
+	init(transit: unknown, messageHandler: unknown, afterConnect: unknown): void;
+	send: unknown;
+	receive: unknown;
+	connected?: boolean;
+	connect(...args: unknown[]): Promise<unknown>;
+	disconnect(): Promise<unknown>;
+	/** TCP transporters keep their sockets on these; both are event emitters. */
+	reader?: unknown;
+	writer?: unknown;
+}
+/** Any Moleculer broker (the d.ts of `ServiceBroker` does not describe what this module drives). */
+export type SwappableBroker = object;
+/** A transporter built for a swap and not yet installed. */
+export interface PendingTransporter {
+	readonly tx: TransporterLike;
+}
+/** The transporter currently installed on the broker (for identity checks). */
+export declare function currentBrokerTransporter(broker: SwappableBroker): PendingTransporter;
+/** Build the transporter an {@link AgentTransport} describes (nothing is bound or dialled yet). */
+export declare function buildTransporter(transport: AgentTransport): PendingTransporter;
+/**
+* Whether `pending` is the transporter installed on the broker right now. A reconnect that was
+* abandoned at its deadline and resumes later must not tear down a newer run's transport.
+*/
+export declare function isInstalledTransporter(broker: SwappableBroker, pending: PendingTransporter): boolean;
+/**
+* Disconnect the installed transporter and forget every remote node. Forgetting is what makes the
+* hub's next INFO a NEW connection: `$node.connected` fires again, so the agent's mesh join re-runs
+* and its settle re-sends the manifest. Without it the hub would still be "available" in the local
+* registry and nothing would re-announce the node.
+*/
+export declare function disconnectBrokerTransport(broker: SwappableBroker): Promise<void>;
+/**
+* Install `pending` as the broker's transporter: the same wiring Moleculer's `Transit` constructor
+* does (init + the broker's send/receive middleware wrapping, which carries the mesh join gate).
+*/
+export declare function installBrokerTransporter(broker: SwappableBroker, pending: PendingTransporter): void;
+/** Connect the installed transporter (the broker's own `start()` path, minus the services). */
+export declare function connectBrokerTransport(broker: SwappableBroker): Promise<void>;
+export {};

package/dist/kernel/moleculer/mesh-mtls/mesh-certificate-registry.d.ts

@@ -78,6 +78,16 @@ export declare class MeshCertificateRegistry {
 	*/
 	settleInterruptedRenewals(): Promise<number>;
 	/** Set a never-completed renewal leaf aside (not current, NOT on the CRL). */
+	/** Fingerprints of renewal leaves whose handover is running right now (this process only). */
+	private readonly renewalsInFlight;
+	/**
+	* A renewal's leaf is "in flight" from signing until the handover ends. While it is, a node seen
+	* presenting its OLD leaf is simply not swapped yet: the new leaf is not set aside (that would
+	* flap set-aside / reinstate on the node's first connection with it).
+	*/
+	beginRenewal(fingerprint: string): void;
+	endRenewal(fingerprint: string): void;
+	private abandonRenewalsNewerThan;
 	abandon(fingerprint: string): Promise<boolean>;
 	/** Replay every persisted revocation into `crl` (hub boot). Set-aside leaves are not revocations. */
 	restoreCrl(crl: MeshCrl): number;

package/dist/kernel/moleculer/mesh-mtls/mesh-peer-transport.d.ts

@@ -28,9 +28,13 @@ export declare function getProcessNodeMeshTransport(nodeId: string): MeshTranspo
 export declare function getProcessPeerLeaf(nodeId: string): MeshPeerLeaf | undefined;
 /** Disconnect `nodeId` (closes its mutual-TLS sockets). `0` when none were open. */
 export declare function dropProcessPeer(nodeId: string): number;
-type RegistrationListener = (nodeId: string) => void;
+type RegistrationListener = (nodeId: string, addonIds?: readonly string[]) => void;
 /** Subscribe to "node X finished registering". Returns the unsubscribe. */
 export declare function onProcessNodeRegistered(listener: RegistrationListener): () => void;
-/** Called by the hub when a node's `registerNode` has been applied. */
-export declare function emitProcessNodeRegistered(nodeId: string): void;
+/**
+* Called by the hub when a node's `registerNode` has been applied. `addonIds` is what that
+* registration carried (a node's own addons and its children's, D3), so a waiter can tell the
+* registration of a node that came back WHOLE from the first one of a node that lost its children.
+*/
+export declare function emitProcessNodeRegistered(nodeId: string, addonIds?: readonly string[]): void;
 export {};

package/dist/kernel/moleculer/mesh-mtls/mesh-renewal.d.ts

@@ -53,7 +53,7 @@ export interface MeshPeers {
 }
 /** "Node X finished registering" - the hub's registration completion (D3), not a poll. */
 export interface MeshRegistrations {
-	subscribe(listener: (nodeId: string) => void): () => void;
+	subscribe(listener: (nodeId: string, addonIds?: readonly string[]) => void): () => void;
 }
 export interface MeshLog {
 	info(message: string, extras?: {
@@ -79,6 +79,13 @@ export interface RenewMeshDeps {
 	/** Registration completions: the node is usable once its manifest has landed. */
 	readonly registrations: MeshRegistrations;
 	readonly log: MeshLog;
+	/**
+	* The addon ids the hub holds for the node BEFORE the renewal (its own and its children's). The
+	* node is "back" only on a registration that carries all of them again: a registration that has
+	* lost its forked children is a node that is online and capless, not a node that came back.
+	* Absent: any registration with the new leaf counts.
+	*/
+	readonly expectedAddons?: (nodeId: string) => readonly string[];
 	/** How long to wait for the node to be back AND registered with the new leaf. */
 	readonly reconnectTimeoutMs?: number;
 	/** Gap between attempts to confirm while the node's capability is not there yet. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.430",
+  "version": "1.2.431",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -501,7 +501,7 @@
     "jose": "^6.2.3",
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.0",
-    "moleculer": "^0.15.0",
+    "moleculer": "0.15.0",
     "otplib": "13.4.1",
     "sqlite-vec": "^0.1.9",
     "superjson": "^2.2.0",