@camstack/system 1.2.431 → 1.2.433

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as readinessKey, Cr as ReadinessRegistry, Dr as asJsonObject$1, F as METHOD_ACCESS_MAP, Fn as scopesAllowAddon, Gt as isArrayOutputSchema, In as scopesAllowDeviceCap, Ir as emitDownForOwnedCaps, Kt as isCollectionArrayMethod, Mn as resolveMethodAuth, N as LOG_LEVEL_RANK, Nr as createEvent$1, Or as asNumber, Rr as expandCapMethods, Rt as extractNestedAddonId, Sn as procedureAuthKey, Sr as RUNTIME_DEFAULTS, Xr as parseJsonObject, Xt as isVoidInput, Y as addonSettingsCapability, Yt as isObjectInput, Zr as parseJsonUnknown, Zt as kebabToCamel$1, _n as objectInputDeclaresRequiredDeviceId, br as DEVICE_STATUS_METHOD, ei as resolveCapMount, gn as objectInputDeclaresAddonId, gr as errMsg$1, kr as asString$1, li as EventCategory$1, ni as scopeKey, nn as lifecycleJobSchema, on as logLevelAtMost, qn as supportedRuntimes, sn as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, vr as DATAPLANE_SECRET_HEADER$1, wr as ReadinessTimeoutError, yr as DEVICE_SETTINGS_CONTRIBUTION_METHODS } from "./dist-CXG6muCR.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-B-BTxeCj.mjs";
+import { $r as parseJsonUnknown, $t as kebabToCamel$1, Ar as asNumber, Br as expandCapMethods, Bt as extractNestedAddonId, Er as ReadinessTimeoutError, F as LOG_LEVEL_RANK, Fr as createEvent$1, Jt as isCollectionArrayMethod, L as METHOD_ACCESS_MAP, Ln as scopesAllowAddon, Pn as resolveMethodAuth, Qr as parseJsonObject, Qt as isVoidInput, Rn as scopesAllowDeviceCap, Rr as emitDownForOwnedCaps, Sr as DEVICE_STATUS_METHOD, Tr as ReadinessRegistry, Yn as supportedRuntimes, Z as addonSettingsCapability, Zt as isObjectInput, br as DATAPLANE_SECRET_HEADER$1, cn as logLevelAtMost, di as EventCategory$1, ii as scopeKey, in as lifecycleJobSchema, jr as asString$1, kr as asJsonObject$1, ln as looseSchema, n as AGENT_MDNS_TXT_KEYS, ni as resolveCapMount, qt as isArrayOutputSchema, r as ALL_CAPABILITY_DEFINITIONS, t as AGENT_MDNS_SERVICE_TYPE, ti as readinessKey, vn as objectInputDeclaresAddonId, vr as errMsg$1, wn as procedureAuthKey, wr as RUNTIME_DEFAULTS, xr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, yn as objectInputDeclaresRequiredDeviceId } from "./dist-DJnlnL7P.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DUrcTW5h.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,21 +21,21 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-vhPZLYuA.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-Bc38yI3r.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { a as setProcessAgentHttpsNames, i as getProcessAgentHttpsNames, n as AGENT_HTTPS_NAMES_COLUMNS, r as AgentHttpsNames, t as AGENT_HTTPS_NAMES_COLLECTION } from "./agent-https-names-uetr4OQl.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CttE77VF.mjs";
-import { $ as verifyAgentUiUnlockTicket, A as setProcessMeshCertificateRegistry, B as generateMeshCa, C as setProcessMeshTlsListenerState, D as RENEWAL_ABANDONED, E as MeshCertificateRegistry, F as requireProcessMeshCa, G as AGENT_DASHBOARD_ORIGINS_FIELD, H as issueMeshLeafForNode, I as caFingerprint, J as AGENT_UI_UNLOCK_VERSION, K as AGENT_UI_UNLOCK_DOMAIN, L as caFingerprintCompact, M as processMeshCrl, N as MeshCaKeeper, O as describeMeshLeaf, P as getProcessMeshCaState, Q as parseAgentDashboardOrigins, R as createMeshCsrPem, S as openMeshTlsWhenRevocationsLoaded, SystemConfigAddon, T as MESH_NODE_CERTIFICATES_COLUMNS, U as issueMeshLeafFromCsr, V as generateMeshKeyPair, W as loadMeshCa, X as isAllowedAgentDashboardReturnTo, Y as UnlockTicketJtiStore, Z as mintAgentUiUnlockTicket, _ as onProcessNodeRegistered, a as ServiceBroker, at as requestProcessMeshEnforcement, b as revokeMeshCertificate, c as enrollMeshNode, ct as setProcessMeshEnforcer, d as processJoinTokenJtiStore, dt as parseCidrList, et as MESH_AUTH_MODE_FIELD, f as verifyMeshJoinToken, ft as readCidrSetting, g as getProcessPeerLeaf, h as getProcessNodeMeshTransport, i as Errors, it as parseMeshAuthMode, j as MeshCrl, k as getProcessMeshCertificateRegistry, l as JoinTokenJtiStore, lt as createCidrMatcher, m as emitProcessNodeRegistered, n as MESH_TLS_PORT_HELLO_FIELD, nt as getProcessMeshAuthStatus, o as Transporters, ot as setProcessMeshAuthMode, p as dropProcessPeer, q as AGENT_UI_UNLOCK_TTL_MS, r as TlsTcpTransporter, rt as isMeshAuthMode, s as setProcessMeshTlsEnabler, st as setProcessMeshAuthStatusSource, tt as getProcessMeshAuthMode, u as mintMeshJoinToken, ut as normalizeIp, v as setProcessMeshPeerTransportLookup, w as MESH_NODE_CERTIFICATES_COLLECTION, x as getProcessMeshTlsListenerState, y as renewMeshCertificate, z as exportMeshPrivateKeyPem } from "./builtins/system-config/system-config.addon.mjs";
+import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-DtRU9A7I.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-Cg9ve13y.mjs";
+import { $ as requireProcessMeshCa, A as dropProcessPeer, At as setProcessMeshAuthStatusSource, B as openMeshTlsWhenRevocationsLoaded, C as Transporters, Ct as MESH_AUTH_MODE_FIELD, D as mintMeshJoinToken, Dt as parseMeshAuthMode, E as JoinTokenJtiStore, Et as isMeshAuthMode, F as onProcessNodeRegistered, Ft as readCidrSetting, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as setProcessMeshPeerTransportLookup, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as renewMeshCertificate, M as getProcessNodeMeshTransport, Mt as createCidrMatcher, N as getProcessPeerLeaf, Nt as normalizeIp, O as processJoinTokenJtiStore, Ot as requestProcessMeshEnforcement, P as isProcessVerifiedMeshPeer, Pt as parseCidrList, Q as getProcessMeshCaState, R as revokeMeshCertificate, S as ServiceBroker, St as verifyAgentUiUnlockTicketEs256, SystemConfigAddon, T as enrollMeshNode, Tt as getProcessMeshAuthStatus, U as MESH_NODE_CERTIFICATES_COLUMNS, V as setProcessMeshTlsListenerState, W as MeshCertificateRegistry, X as processMeshCrl, Y as MeshCrl, Z as MeshCaKeeper, _ as signPairingProof, _t as isAllowedAgentDashboardReturnTo, a as hubHostFromMeshAddress, at as generateMeshKeyPair, b as TlsTcpTransporter, bt as parseAgentDashboardOrigins, c as PAIRING_MAX_SESSIONS, ct as issueMeshLeafFromCsr, d as PAIRING_PROTOCOL, dt as AGENT_UI_UNLOCK_DOMAIN, et as caFingerprint, f as PAIRING_TTL_MS, ft as AGENT_UI_UNLOCK_TTL_MS, g as keyFingerprintShort, gt as UnlockTicketJtiStore, h as describeCsr, ht as AGENT_UI_UNLOCK_VERSION, i as AgentPairing, it as generateMeshCa, j as emitProcessNodeRegistered, jt as setProcessMeshEnforcer, k as verifyMeshJoinToken, kt as setProcessMeshAuthMode, l as PAIRING_PATHS, lt as loadMeshCa, m as computePairingSas, mt as AGENT_UI_UNLOCK_USE, n as HubPairing, nt as createMeshCsrPem, o as PAIRING_CODE_DIGITS, ot as isValidAgentNodeId, p as computePairingCommitment, pt as AGENT_UI_UNLOCK_TYP, q as getProcessMeshCertificateRegistry, r as PairingHttpError, rt as exportMeshPrivateKeyPem, s as PAIRING_MAX_CODE_ATTEMPTS, st as issueMeshLeafForNode, tt as caFingerprintCompact, u as PAIRING_PIN_DIGITS, ut as AGENT_DASHBOARD_ORIGINS_FIELD, v as verifyPairingProof, vt as mintAgentUiUnlockTicket, w as setProcessMeshTlsEnabler, wt as getProcessMeshAuthMode, x as Errors, xt as verifyAgentUiUnlockTicket, y as MESH_TLS_PORT_HELLO_FIELD, yt as mintAgentUiUnlockTicketEs256, z as getProcessMeshTlsListenerState } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { A as readTlsMode, B as CA_VALIDITY_DAYS, C as registerHttpsListener, D as UPLOADED_CA_FILE, E as prepareBootTls, F as loadTlsCert, G as DEFAULT_LAN_HTTP_PORT, H as MAX_LEAF_VALIDITY_DAYS, I as reissueTlsLeaf, J as bindPendingLanHttp, K as allFamiliesListenHost, L as CA_COMMON_NAME, M as writeExtraSans, N as writeTlsMode, O as readExtraSans, P as ensureTlsCert, R as collectCertIdentity, S as leafFingerprintOf, T as servedHttpsLeafFingerprint, U as SERVER_AUTH_OID, V as LEAF_RENEWAL_WINDOW_DAYS, W as evaluateExistingCert, X as readLanHttpState, Y as closeLanHttp, Z as registerLanHttpHandler, _ as regenerateCertificate, a as collectAgentNames, b as validateUploadedTls, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as applyCertificateToListener, h as pinnedHttpsCaFingerprint, i as certificateNames, j as splitPemCertificates, k as readTlsAccessStatus, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, q as applyLanHttp, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, v as revertToGeneratedCertificate, w as reloadHttpsListener, x as clearHttpsListener, y as storeUploadedCertificate, z as systemHostFacts } from "./tls-CpcGkeJV.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-8_Ed1Za5.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-D_wBL1OO.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-C3_rzOCx.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -5432,6 +5432,88 @@ var StorageManager = class {
 	}
 };
 //#endregion
+//#region src/builtins/local-network/agent-mdns.ts
+function buildAgentAnnouncement(inputs) {
+	const txt = {
+		[AGENT_MDNS_TXT_KEYS.nodeId]: inputs.nodeId,
+		[AGENT_MDNS_TXT_KEYS.state]: inputs.state
+	};
+	if (inputs.version !== null) txt[AGENT_MDNS_TXT_KEYS.version] = inputs.version;
+	if (inputs.leafFingerprint !== null) txt[AGENT_MDNS_TXT_KEYS.keyFingerprint] = inputs.leafFingerprint;
+	return {
+		name: `camstack-agent-${inputs.nodeId}`,
+		type: AGENT_MDNS_SERVICE_TYPE,
+		port: inputs.port,
+		address: null,
+		txt
+	};
+}
+function announcementKey(a) {
+	return JSON.stringify([
+		a.name,
+		a.type,
+		a.port,
+		a.txt
+	]);
+}
+/**
+* Keeps one mDNS service in step with the agent's pairing state. `sync()` is safe
+* to call on any change; it never throws — a failure to advertise is logged and
+* the agent goes on (a typed address still pairs it).
+*/
+var AgentMdnsAdvertiser = class {
+	options;
+	current = null;
+	running = false;
+	chain = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	start(inputs) {
+		this.running = true;
+		return this.sync(inputs);
+	}
+	/** Announce `inputs` if they differ from what is announced. Serialised. */
+	sync(inputs) {
+		this.chain = this.chain.then(() => this.syncOnce(inputs));
+		return this.chain;
+	}
+	async stop() {
+		this.running = false;
+		await (this.chain = this.chain.then(() => this.withdraw()));
+	}
+	async syncOnce(inputs) {
+		if (!this.running) return;
+		const next = buildAgentAnnouncement(inputs);
+		const key = announcementKey(next);
+		if (this.current?.key === key) return;
+		try {
+			await this.withdraw();
+			const handle = await this.options.publisher.publish(next);
+			this.current = {
+				key,
+				handle
+			};
+			this.options.logger.info("agent mDNS: advertising _camstack-agent._tcp", { meta: {
+				state: inputs.state,
+				port: inputs.port
+			} });
+		} catch (err) {
+			this.options.logger.warn("agent mDNS: could not advertise this agent (a hub can still pair it by address)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	async withdraw() {
+		const held = this.current;
+		this.current = null;
+		if (held === null) return;
+		try {
+			await held.handle.stop();
+		} catch (err) {
+			this.options.logger.warn("agent mDNS: withdraw failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/integration-registry.ts
 function serializeSetting(value) {
 	if (typeof value === "number") return {
@@ -24079,7 +24161,7 @@ var MeshAuthenticator = class {
 	}
 	admitSender(sender, what) {
 		const state = this.stateOf(sender);
-		if (state === "authenticated") return { verdict: "allow" };
+		if (state === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
 		if (this.deps.mode() === "enforced") return {
 			verdict: "deny",
 			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
@@ -24097,7 +24179,7 @@ var MeshAuthenticator = class {
 	admitRegistration(sender, params) {
 		if (sender === this.deps.ownNodeId) return;
 		if (params.nodeId !== sender) throw refuse(`registration refused: node "${sender}" may register only itself, not "${params.nodeId}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
-		if (this.stateOf(sender) === "authenticated") return;
+		if (this.stateOf(sender) === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return;
 		if (this.deps.mode() === "enforced") throw refuse(`cluster secret mismatch — node "${sender}" rejected: this hub requires agents to authenticate with the cluster secret (System → Cluster); update the agent and enter it`, CLUSTER_SECRET_MISMATCH_TYPE);
 		if (params.clusterSecretHash === void 0) {
 			this.admitSender(sender, "$hub.registerNode");
@@ -24420,9 +24502,9 @@ var AgentMeshAuthenticator = class {
 	heldCount() {
 		return this.hold.size;
 	}
-	/** Current mode: secret configured → enforce; else tolerate (upgrade path). */
+	/** Current mode: a secret OR a certificate → enforce; else tolerate (upgrade path). */
 	mode() {
-		return this.deps.hasSecret() ? "enforced" : "transition";
+		return this.deps.hasSecret() || this.deps.isPaired?.() === true ? "enforced" : "transition";
 	}
 	/**
 	* Reflect a settled mesh join. `authenticated` stamps the hub; a blocking
@@ -24475,6 +24557,7 @@ var AgentMeshAuthenticator = class {
 	admitSender(sender, what, kind) {
 		const state = this.stateOf(sender);
 		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
+		if (sender === this.hubNodeId && this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
 		if (this.mode() === "enforced") {
 			if (sender === this.hubNodeId) {
 				const held = this.hold.hold(kind);
@@ -27028,4 +27111,4 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectAgentNames, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isPrivateAddress, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshCertificateRegistry, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshAuthenticator, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectAgentNames, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintAgentUiUnlockTicketEs256, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshCertificateRegistry, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyAgentUiUnlockTicketEs256, verifyDeviceLeaf, verifyDeviceSignature, verifyMeshJoinToken, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -41,8 +41,9 @@ export { createAgentTransport, createBroker, deriveAgentListenPort, getBrokerTls
 export type { AgentTransport, BrokerConfig } from "./moleculer/broker-factory.js";
 export { buildTransporter, connectBrokerTransport, currentBrokerTransporter, disconnectBrokerTransport, installBrokerTransporter, isInstalledTransporter } from "./moleculer/broker-transport-swap.js";
 export type { PendingTransporter } from "./moleculer/broker-transport-swap.js";
-export { caFingerprint, caFingerprintCompact, describeMeshLeaf, dropProcessPeer, emitProcessNodeRegistered, onProcessNodeRegistered, getProcessMeshCertificateRegistry, getProcessPeerLeaf, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, getProcessMeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, RENEWAL_ABANDONED, setProcessMeshTlsListenerState, renewMeshCertificate, revokeMeshCertificate, setProcessMeshCertificateRegistry, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
-export type { MeshCertificateRecord, MeshLeafDescription, MeshLog, MeshPeerLeaf, MeshPeers, MeshRegistrations, MeshTlsListenerState, NodeMeshClient, RenewMeshResult, RevokeMeshResult, MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
+export { caFingerprint, caFingerprintCompact, describeMeshLeaf, dropProcessPeer, emitProcessNodeRegistered, onProcessNodeRegistered, getProcessMeshCertificateRegistry, getProcessPeerLeaf, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, getProcessMeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, RENEWAL_ABANDONED, setProcessMeshTlsListenerState, renewMeshCertificate, revokeMeshCertificate, setProcessMeshCertificateRegistry, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, isProcessVerifiedMeshPeer, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
+export type { MeshCertificateRecord, MeshLeafDescription, MeshLog, MeshPeerLeaf, MeshPeers, MeshRegistrations, MeshTlsListenerState, NodeMeshClient, RenewMeshResult, RevokeMeshResult, MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial, VerifiedMeshPeer } from "./moleculer/mesh-mtls/index.js";
+export * from "./moleculer/mesh-mtls/pairing/index.js";
 export { type AddonDeploySource, isAddonDeploySource } from "./moleculer/addon-deploy-source.js";
 export { createAddonService, validateProviderRegistrations } from "./moleculer/addon-service-factory.js";
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from "./moleculer/core-cap-service.js";
@@ -75,8 +76,8 @@ export type { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinCh
 export { getProcessMeshAuthMode, getProcessMeshAuthStatus, isMeshAuthMode, MESH_AUTH_MODE_FIELD, parseMeshAuthMode, requestProcessMeshEnforcement, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer } from "./moleculer/mesh-auth-mode.js";
 export { decideMeshAutoEnforce, MESH_AUTO_ENFORCE_GRACE_MS } from "./moleculer/mesh-auto-enforce.js";
 export type { MeshAutoEnforceDecision, MeshAutoEnforceInput } from "./moleculer/mesh-auto-enforce.js";
-export { AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, isAllowedAgentDashboardReturnTo, mintAgentUiUnlockTicket, parseAgentDashboardOrigins, UnlockTicketJtiStore, verifyAgentUiUnlockTicket } from "./moleculer/agent-ui-unlock.js";
-export type { AgentUiUnlockPayload, MintAgentUiUnlockTicketInput, VerifyAgentUiUnlockTicketOptions } from "./moleculer/agent-ui-unlock.js";
+export { AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, mintAgentUiUnlockTicketEs256, verifyAgentUiUnlockTicketEs256, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, isAllowedAgentDashboardReturnTo, mintAgentUiUnlockTicket, parseAgentDashboardOrigins, UnlockTicketJtiStore, verifyAgentUiUnlockTicket } from "./moleculer/agent-ui-unlock.js";
+export type { AgentUiUnlockPayload, MintAgentUiUnlockTicketEs256Input, MintAgentUiUnlockTicketInput, VerifyAgentUiUnlockTicketEs256Options, VerifyAgentUiUnlockTicketOptions } from "./moleculer/agent-ui-unlock.js";
 export type { MeshAuthMode, MeshAuthStatus, MeshEnforcer, MeshNodeAuthEntry, MeshNodeAuthState } from "./moleculer/mesh-auth-mode.js";
 export { serializeTypedArrays } from "./moleculer/typed-array-serde.js";
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME } from "./moleculer/readiness-service.js";

package/dist/kernel/moleculer/agent-mesh-authenticator.d.ts

@@ -41,6 +41,17 @@ export interface AgentMeshAuthenticatorDeps {
 	readonly hubNodeId?: string;
 	/** True when `agent.json` holds a cluster secret. */
 	readonly hasSecret: () => boolean;
+	/**
+	* D857 (transition release): the hub is accepted when its mutual-TLS leaf chained to the CA
+	* this agent pinned, its CN is the hub's node id and it is not revoked — in ADDITION to the
+	* mutual join. A hub that no longer answers the join (the removal release) is served at once.
+	*/
+	readonly isVerifiedPeer?: (nodeId: string) => boolean;
+	/**
+	* True when `agent.json` holds mesh material. A paired agent is `enforced` even with no cluster
+	* secret (D857): without this, an agent paired by certificate would tolerate strangers.
+	*/
+	readonly isPaired?: () => boolean;
 	readonly now?: () => number;
 	/** First time a peer is tolerated without proof on this connection. */
 	readonly onTolerated?: (nodeId: string, action: string) => void;
@@ -59,7 +70,7 @@ export declare class AgentMeshAuthenticator {
 	constructor(deps: AgentMeshAuthenticatorDeps);
 	/** How many of the hub's requests wait for the join right now. */
 	heldCount(): number;
-	/** Current mode: secret configured → enforce; else tolerate (upgrade path). */
+	/** Current mode: a secret OR a certificate → enforce; else tolerate (upgrade path). */
 	mode(): MeshAuthMode;
 	/**
 	* Reflect a settled mesh join. `authenticated` stamps the hub; a blocking

package/dist/kernel/moleculer/agent-ui-unlock.d.ts

@@ -1,5 +1,11 @@
 export declare const AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
 export declare const AGENT_UI_UNLOCK_VERSION: 1;
+/**
+* D857 (transition release): a ticket signed by the MESH CA key (ES256 JWS) is accepted by an agent
+* IN ADDITION to the HMAC ticket. The removal release mints only this form.
+*/
+export declare const AGENT_UI_UNLOCK_TYP = "camstack-agent-ui-unlock+jwt";
+export declare const AGENT_UI_UNLOCK_USE = "agent-ui-unlock";
 /** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
 export declare const AGENT_UI_UNLOCK_TTL_MS: number;
 /**
@@ -10,6 +16,8 @@ export declare const AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
 export interface AgentUiUnlockPayload {
 	readonly v: typeof AGENT_UI_UNLOCK_VERSION;
 	readonly nodeId: string;
+	/** Epoch ms the ticket was issued; `exp - iat` never exceeds {@link AGENT_UI_UNLOCK_TTL_MS}. */
+	readonly iat: number;
 	/** Epoch ms. */
 	readonly exp: number;
 	readonly jti: string;
@@ -36,6 +44,11 @@ export declare function mintAgentUiUnlockTicket(input: MintAgentUiUnlockTicketIn
 export interface VerifyAgentUiUnlockTicketOptions {
 	readonly expectedNodeId: string;
 	readonly nowMs?: number;
+	/**
+	* Refuse a ticket issued before this instant (the agent's boot): the one-use ledger lives in
+	* memory, so a ticket from before a restart could otherwise be replayed.
+	*/
+	readonly notBeforeMs?: number;
 }
 /**
 * Verify a ticket under `secretHash`. Returns the payload, or `null` when the
@@ -49,4 +62,31 @@ export declare function verifyAgentUiUnlockTicket(secretHash: string, ticket: st
 */
 export declare function isAllowedAgentDashboardReturnTo(returnTo: string, extraOrigins?: readonly string[]): boolean;
 /** Parse a stored comma/whitespace-separated origins list. */
+/**
+* True when `returnTo` points at an address the hub itself knows for the node (`knownNames`: its id
+* and the address of its live mesh socket), or at an origin the operator listed. `knownNames` of
+* `null` (nothing recorded for the node yet) refuses.
+*/
+export declare function isKnownAgentAddress(returnTo: string, knownNames: readonly string[] | null, listedOrigins?: readonly string[]): boolean;
 export declare function parseAgentDashboardOrigins(stored: unknown): readonly string[];
+export interface MintAgentUiUnlockTicketEs256Input {
+	/** The mesh CA's private key, PKCS#8 PEM (`MeshCaSigner.keyPem`). */
+	readonly caKeyPem: string;
+	readonly nodeId: string;
+	readonly ttlMs?: number;
+	readonly nowMs?: number;
+	readonly jti?: string;
+}
+export declare function mintAgentUiUnlockTicketEs256(input: MintAgentUiUnlockTicketEs256Input): string;
+export interface VerifyAgentUiUnlockTicketEs256Options {
+	readonly expectedNodeId: string;
+	readonly nowMs?: number;
+	/** Refuse a ticket issued before this instant (the agent's boot). */
+	readonly notBeforeMs?: number;
+}
+/**
+* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
+* payload, or `null` when the signature, header, shape, expiry or nodeId fails
+* (no reason string — refuse quietly).
+*/
+export declare function verifyAgentUiUnlockTicketEs256(caCertPem: string, ticket: string, options: VerifyAgentUiUnlockTicketEs256Options): AgentUiUnlockPayload | null;

package/dist/kernel/moleculer/mesh-authenticator.d.ts

@@ -21,6 +21,12 @@ export interface MeshAuthenticatorDeps {
 	/** The cluster secret as the keychain answers it now (D797). */
 	readonly gate: () => ClusterSecretGate;
 	readonly mode: () => MeshAuthMode;
+	/**
+	* D857 (transition release): a node whose mutual-TLS handshake chained to the mesh CA, whose CN
+	* is its node id and whose leaf is not revoked is admitted WITHOUT the challenge–response. The
+	* join stays answered for agents that still need it.
+	*/
+	readonly isVerifiedPeer?: (nodeId: string) => boolean;
 	readonly now?: () => number;
 	/** A node completed the challenge–response. */
 	readonly onAuthenticated?: (nodeId: string) => void;

package/dist/kernel/moleculer/mesh-mtls/constants.d.ts

@@ -2,7 +2,7 @@
 export declare const MESH_CA_KEY_REF: string;
 /** `system-settings` key holding the public CA certificate PEM. */
 export declare const MESH_CA_SETTINGS_KEY = "cluster.meshCa";
-/** Field inside the `cluster` section (same row as the secret). */
+/** Field inside the `cluster` section. */
 export declare const MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 export declare const MESH_JOIN_TOKEN_MAX_TTL_SEC: number;

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -5,9 +5,10 @@ export { clearProcessMeshCrl, MeshCrl, processMeshCrl } from "./mesh-crl.js";
 export { describeMeshLeaf, getProcessMeshCertificateRegistry, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, RENEWAL_ABANDONED, setProcessMeshCertificateRegistry, type MeshCertificateRecord, type MeshCertificateVia, type MeshLeafDescription } from "./mesh-certificate-registry.js";
 export { getProcessMeshTlsListenerState, type MeshTlsGateDeps, type MeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, setProcessMeshTlsListenerState } from "./mesh-tls-gate.js";
 export { renewMeshCertificate, revokeMeshCertificate, type MeshLog, type MeshPeers, type MeshRegistrations, type NodeMeshClient, type RenewMeshDeps, type RenewMeshResult, type RevokeMeshResult } from "./mesh-renewal.js";
-export { dropProcessPeer, emitProcessNodeRegistered, getProcessPeerLeaf, onProcessNodeRegistered, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, type MeshPeerLeaf, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
+export { dropProcessPeer, emitProcessNodeRegistered, getProcessPeerLeaf, onProcessNodeRegistered, getProcessNodeMeshTransport, isProcessVerifiedMeshPeer, setProcessMeshPeerTransportLookup, type MeshPeerLeaf, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
 export { enrollMeshNode } from "./mesh-enroll.js";
 export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult } from "./mesh-enroll.js";
 export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput } from "./mesh-join-token.js";
 export { getProcessMeshTlsEnabler, requestProcessMeshTlsEnable, setProcessMeshTlsEnabler, type MeshTlsEnabler } from "./mesh-tls-enabler.js";
-export { helloMeshTlsPort, keepOnlyGossipNodes, MESH_TLS_PORT_HELLO_FIELD, TlsTcpTransporter, type FilteredGossip, type MeshTlsMaterial, type TlsTcpTransporterOptions } from "./tls-tcp-transporter.js";
+export { helloMeshTlsPort, keepOnlyGossipNodes, MESH_TLS_PORT_HELLO_FIELD, TlsTcpTransporter, type FilteredGossip, type MeshTlsMaterial, type TlsTcpTransporterOptions, type VerifiedMeshPeer } from "./tls-tcp-transporter.js";
+export * from "./pairing/index.js";

package/dist/kernel/moleculer/mesh-mtls/mesh-ca.d.ts

@@ -13,6 +13,8 @@ import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 export declare const MESH_KEY_ALGORITHM: WebCrypto.EcKeyGenParams;
 /** Signing — ECDSA with SHA-256. */
 export declare const MESH_SIGNING_ALGORITHM: WebCrypto.EcdsaParams;
+/** True for an id an agent may carry: the pattern, and not a reserved name. */
+export declare function isValidAgentNodeId(nodeId: string): boolean;
 export interface MeshCaSigner {
 	readonly certPem: string;
 	readonly keyPem: string;
@@ -40,6 +42,8 @@ export declare function issueMeshLeafFromCsr(ca: MeshCaSigner, csrPem: string, o
 	readonly expectedNodeId?: string;
 	readonly now?: Date;
 	readonly validDays?: number;
+	/** The hub's own leaf, made in-process from a key it generated itself (never a remote CSR). */
+	readonly allowReserved?: boolean;
 }): Promise<MeshLeafMaterial>;
 /** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
 export declare function issueMeshLeafForNode(ca: MeshCaSigner, nodeId: string, opts?: {

package/dist/kernel/moleculer/mesh-mtls/mesh-certificate-registry.d.ts

@@ -9,7 +9,7 @@ import type { MeshCrl } from "./mesh-crl.js";
 */
 export declare const MESH_NODE_CERTIFICATES_COLLECTION = "mesh_node_certificates";
 export declare const MESH_NODE_CERTIFICATES_COLUMNS: readonly CollectionColumn[];
-export type MeshCertificateVia = "enroll" | "renewal" | "boot" | "observed";
+export type MeshCertificateVia = "enroll" | "pairing" | "renewal" | "boot" | "observed";
 export interface MeshCertificateRecord {
 	readonly nodeId: string;
 	readonly serial: string;
@@ -70,7 +70,7 @@ export declare class MeshCertificateRegistry {
 	* valid just because the hub once set it aside). Returns the serials put on the CRL.
 	* A leaf revoked this way is never reinstated by `recordObserved`.
 	*/
-	revokeAllForNode(nodeId: string, reason: string, crl: MeshCrl): Promise<readonly string[]>;
+	revokeAllForNode(nodeId: string, reason: string, crl: MeshCrl, keepFingerprint?: string): Promise<readonly string[]>;
 	/**
 	* At boot: a node with TWO live leaves had a renewal in flight when the hub stopped. The
 	* newer (renewal) one is set aside - it is not the node's current leaf until the node is

package/dist/kernel/moleculer/mesh-mtls/mesh-join-token.d.ts

@@ -5,7 +5,7 @@ export interface MeshJoinTokenClaims {
 	readonly hubUrl: string;
 	readonly hubMeshAddress: string;
 	readonly caFingerprint: string;
-	readonly nodeId?: string;
+	readonly nodeId: string;
 	readonly jti: string;
 	readonly exp: number;
 }
@@ -32,7 +32,8 @@ export interface MintJoinTokenInput {
 	readonly ca: MeshCaSigner;
 	readonly hubUrl: string;
 	readonly hubMeshAddress: string;
-	readonly nodeId?: string;
+	/** The node this token is for - mandatory. */
+	readonly nodeId: string;
 	/** Seconds from now; capped at {@link MESH_JOIN_TOKEN_MAX_TTL_SEC}. */
 	readonly ttlSec?: number;
 	readonly now?: Date;

package/dist/kernel/moleculer/mesh-mtls/mesh-peer-transport.d.ts

@@ -19,6 +19,11 @@ export interface MeshPeerTransportLookup {
 	peerLeaf?(nodeId: string): MeshPeerLeaf | undefined;
 	/** Close every live mutual-TLS socket of `nodeId`. Returns how many were closed. */
 	dropPeer?(nodeId: string): number;
+	/**
+	* Whether `nodeId` is a certificate-verified mesh peer (D857): its leaf chains to the mesh CA,
+	* its CN is `nodeId` and the serial is not revoked. The hub's mesh gate reads this.
+	*/
+	isVerifiedPeer?(nodeId: string): boolean;
 }
 /** Published by the hub broker owner; cleared on shutdown. */
 export declare function setProcessMeshPeerTransportLookup(lookup: MeshPeerTransportLookup | null): void;
@@ -26,6 +31,8 @@ export declare function setProcessMeshPeerTransportLookup(lookup: MeshPeerTransp
 export declare function getProcessNodeMeshTransport(nodeId: string): MeshTransport | undefined;
 /** The leaf `nodeId` presented on its live connection, or `undefined`. */
 export declare function getProcessPeerLeaf(nodeId: string): MeshPeerLeaf | undefined;
+/** True when the hub's transporter holds a certificate-verified mesh peer called `nodeId` (D857). */
+export declare function isProcessVerifiedMeshPeer(nodeId: string): boolean;
 /** Disconnect `nodeId` (closes its mutual-TLS sockets). `0` when none were open. */
 export declare function dropProcessPeer(nodeId: string): number;
 type RegistrationListener = (nodeId: string, addonIds?: readonly string[]) => void;