@camstack/system 1.2.432 → 1.2.434

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BCKOeWu_.js");
-const require_device_ca = require("./device-ca-BCyAPmIj.js");
+const require_dist = require("./dist-CCH3XPqO.js");
+const require_device_ca = require("./device-ca-D21ZP00q.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,21 +22,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-ChzCPUi2.js");
+const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https_names = require("./agent-https-names-CpUSuP4w.js");
-const require_constants = require("./constants-DfP8V3eX.js");
+const require_agent_https = require("./agent-https-BZIwS4xF.js");
+const require_constants = require("./constants-CuOfMdYe.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_tls = require("./tls-C5IYg3V5.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DhHH7VQp.js");
+const require_restore_archive = require("./restore-archive-Do0QwAik.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -5435,6 +5435,88 @@ var StorageManager = class {
 	}
 };
 //#endregion
+//#region src/builtins/local-network/agent-mdns.ts
+function buildAgentAnnouncement(inputs) {
+	const txt = {
+		[require_dist.AGENT_MDNS_TXT_KEYS.nodeId]: inputs.nodeId,
+		[require_dist.AGENT_MDNS_TXT_KEYS.state]: inputs.state
+	};
+	if (inputs.version !== null) txt[require_dist.AGENT_MDNS_TXT_KEYS.version] = inputs.version;
+	if (inputs.leafFingerprint !== null) txt[require_dist.AGENT_MDNS_TXT_KEYS.keyFingerprint] = inputs.leafFingerprint;
+	return {
+		name: `camstack-agent-${inputs.nodeId}`,
+		type: require_dist.AGENT_MDNS_SERVICE_TYPE,
+		port: inputs.port,
+		address: null,
+		txt
+	};
+}
+function announcementKey(a) {
+	return JSON.stringify([
+		a.name,
+		a.type,
+		a.port,
+		a.txt
+	]);
+}
+/**
+* Keeps one mDNS service in step with the agent's pairing state. `sync()` is safe
+* to call on any change; it never throws — a failure to advertise is logged and
+* the agent goes on (a typed address still pairs it).
+*/
+var AgentMdnsAdvertiser = class {
+	options;
+	current = null;
+	running = false;
+	chain = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	start(inputs) {
+		this.running = true;
+		return this.sync(inputs);
+	}
+	/** Announce `inputs` if they differ from what is announced. Serialised. */
+	sync(inputs) {
+		this.chain = this.chain.then(() => this.syncOnce(inputs));
+		return this.chain;
+	}
+	async stop() {
+		this.running = false;
+		await (this.chain = this.chain.then(() => this.withdraw()));
+	}
+	async syncOnce(inputs) {
+		if (!this.running) return;
+		const next = buildAgentAnnouncement(inputs);
+		const key = announcementKey(next);
+		if (this.current?.key === key) return;
+		try {
+			await this.withdraw();
+			const handle = await this.options.publisher.publish(next);
+			this.current = {
+				key,
+				handle
+			};
+			this.options.logger.info("agent mDNS: advertising _camstack-agent._tcp", { meta: {
+				state: inputs.state,
+				port: inputs.port
+			} });
+		} catch (err) {
+			this.options.logger.warn("agent mDNS: could not advertise this agent (a hub can still pair it by address)", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	async withdraw() {
+		const held = this.current;
+		this.current = null;
+		if (held === null) return;
+		try {
+			await held.handle.stop();
+		} catch (err) {
+			this.options.logger.warn("agent mDNS: withdraw failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/integration-registry.ts
 function serializeSetting(value) {
 	if (typeof value === "number") return {
@@ -24082,7 +24164,7 @@ var MeshAuthenticator = class {
 	}
 	admitSender(sender, what) {
 		const state = this.stateOf(sender);
-		if (state === "authenticated") return { verdict: "allow" };
+		if (state === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
 		if (this.deps.mode() === "enforced") return {
 			verdict: "deny",
 			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
@@ -24100,7 +24182,7 @@ var MeshAuthenticator = class {
 	admitRegistration(sender, params) {
 		if (sender === this.deps.ownNodeId) return;
 		if (params.nodeId !== sender) throw refuse(`registration refused: node "${sender}" may register only itself, not "${params.nodeId}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
-		if (this.stateOf(sender) === "authenticated") return;
+		if (this.stateOf(sender) === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return;
 		if (this.deps.mode() === "enforced") throw refuse(`cluster secret mismatch — node "${sender}" rejected: this hub requires agents to authenticate with the cluster secret (System → Cluster); update the agent and enter it`, require_constants.CLUSTER_SECRET_MISMATCH_TYPE);
 		if (params.clusterSecretHash === void 0) {
 			this.admitSender(sender, "$hub.registerNode");
@@ -24423,9 +24505,9 @@ var AgentMeshAuthenticator = class {
 	heldCount() {
 		return this.hold.size;
 	}
-	/** Current mode: secret configured → enforce; else tolerate (upgrade path). */
+	/** Current mode: a secret OR a certificate → enforce; else tolerate (upgrade path). */
 	mode() {
-		return this.deps.hasSecret() ? "enforced" : "transition";
+		return this.deps.hasSecret() || this.deps.isPaired?.() === true ? "enforced" : "transition";
 	}
 	/**
 	* Reflect a settled mesh join. `authenticated` stamps the hub; a blocking
@@ -24478,6 +24560,7 @@ var AgentMeshAuthenticator = class {
 	admitSender(sender, what, kind) {
 		const state = this.stateOf(sender);
 		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
+		if (sender === this.hubNodeId && this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
 		if (this.mode() === "enforced") {
 			if (sender === this.hubNodeId) {
 				const held = this.hold.hold(kind);
@@ -27036,12 +27119,14 @@ exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_
 exports.AGENT_CAP_FWD_ACTION = AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = AGENT_CAP_FWD_SERVICE;
 exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
-exports.AGENT_HTTPS_NAMES_COLLECTION = require_agent_https_names.AGENT_HTTPS_NAMES_COLLECTION;
-exports.AGENT_HTTPS_NAMES_COLUMNS = require_agent_https_names.AGENT_HTTPS_NAMES_COLUMNS;
+exports.AGENT_HTTPS_NAMES_COLLECTION = require_agent_https.AGENT_HTTPS_NAMES_COLLECTION;
+exports.AGENT_HTTPS_NAMES_COLUMNS = require_agent_https.AGENT_HTTPS_NAMES_COLUMNS;
 exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
 exports.AGENT_REGISTER_NODE_ACTION = AGENT_REGISTER_NODE_ACTION;
 exports.AGENT_UI_UNLOCK_DOMAIN = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_DOMAIN;
 exports.AGENT_UI_UNLOCK_TTL_MS = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_TTL_MS;
+exports.AGENT_UI_UNLOCK_TYP = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_TYP;
+exports.AGENT_UI_UNLOCK_USE = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_USE;
 exports.AGENT_UI_UNLOCK_VERSION = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_VERSION;
 exports.ALL_CAPABILITY_DEFINITIONS = require_dist.ALL_CAPABILITY_DEFINITIONS;
 exports.ARRAY_BUFFER_CENSUS_COOLDOWN_MS = ARRAY_BUFFER_CENSUS_COOLDOWN_MS;
@@ -27057,9 +27142,11 @@ exports.AddonLoader = AddonLoader;
 exports.AddonManifest = AddonManifest;
 exports.AddonRouteRegistry = AddonRouteRegistry;
 exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTokenManager;
-exports.AgentHttpsInstallError = require_tls.AgentHttpsInstallError;
-exports.AgentHttpsNames = require_agent_https_names.AgentHttpsNames;
+exports.AgentHttpsInstallError = require_agent_https.AgentHttpsInstallError;
+exports.AgentHttpsNames = require_agent_https.AgentHttpsNames;
+exports.AgentMdnsAdvertiser = AgentMdnsAdvertiser;
 exports.AgentMeshAuthenticator = AgentMeshAuthenticator;
+exports.AgentPairing = require_builtins_system_config_system_config_addon.AgentPairing;
 exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
 exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
 exports.AuthAuditLog = require_builtins_local_auth_local_auth_addon.AuthAuditLog;
@@ -27071,8 +27158,8 @@ exports.BackupKeyRequiredError = require_restore_archive.BackupKeyRequiredError;
 exports.CAP_ACTION_OVERFLOW_LABEL = CAP_ACTION_OVERFLOW_LABEL;
 exports.CAP_ACTION_UNLABELLED = CAP_ACTION_UNLABELLED;
 exports.CAP_METHOD_NOT_IMPLEMENTED = CAP_METHOD_NOT_IMPLEMENTED;
-exports.CA_COMMON_NAME = require_tls.CA_COMMON_NAME;
-exports.CA_VALIDITY_DAYS = require_tls.CA_VALIDITY_DAYS;
+exports.CA_COMMON_NAME = require_agent_https.CA_COMMON_NAME;
+exports.CA_VALIDITY_DAYS = require_agent_https.CA_VALIDITY_DAYS;
 exports.CLUSTER_SECRET_MISMATCH_TYPE = require_constants.CLUSTER_SECRET_MISMATCH_TYPE;
 exports.CLUSTER_SECRET_REF = require_constants.CLUSTER_SECRET_REF;
 exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = require_constants.CLUSTER_SECRET_REJECTED_EXIT_CODE;
@@ -27096,7 +27183,7 @@ exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegist
 exports.DECISIVE_HEAP_SPACES = DECISIVE_HEAP_SPACES;
 exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_HUB_TLS_TCP_PORT = require_constants.DEFAULT_HUB_TLS_TCP_PORT;
-exports.DEFAULT_LAN_HTTP_PORT = require_tls.DEFAULT_LAN_HTTP_PORT;
+exports.DEFAULT_LAN_HTTP_PORT = require_hub_mdns_ciao.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
 exports.DEFAULT_MESH_JOIN_MAX_HELD = DEFAULT_MESH_JOIN_MAX_HELD;
 exports.DEFAULT_MESH_JOIN_MAX_HOLD_MS = DEFAULT_MESH_JOIN_MAX_HOLD_MS;
@@ -27142,13 +27229,14 @@ exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAdd
 exports.HubForwarderDestination = require_builtins_hub_forwarder_index.HubForwarderDestination$1;
 exports.HubLogForwarder = HubLogForwarder;
 exports.HubNodeRegistry = HubNodeRegistry;
+exports.HubPairing = require_builtins_system_config_system_config_addon.HubPairing;
 exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
 exports.JWT_SIGNING_KEY_REF = require_device_ca.JWT_SIGNING_KEY_REF;
 exports.JobJournal = JobJournal;
 exports.JoinTokenJtiStore = require_builtins_system_config_system_config_addon.JoinTokenJtiStore;
 exports.JwtSigningKeyUnavailableError = require_device_ca.JwtSigningKeyUnavailableError;
-exports.LEAF_RENEWAL_WINDOW_DAYS = require_tls.LEAF_RENEWAL_WINDOW_DAYS;
+exports.LEAF_RENEWAL_WINDOW_DAYS = require_agent_https.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
 exports.LifecycleStateMachine = LifecycleStateMachine;
 exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
@@ -27162,7 +27250,7 @@ exports.LoginSessionManager = require_builtins_local_auth_local_auth_addon.Login
 exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
 exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
 exports.MAX_CAP_ACTIONS_PER_PEER = MAX_CAP_ACTIONS_PER_PEER;
-exports.MAX_LEAF_VALIDITY_DAYS = require_tls.MAX_LEAF_VALIDITY_DAYS;
+exports.MAX_LEAF_VALIDITY_DAYS = require_agent_https.MAX_LEAF_VALIDITY_DAYS;
 exports.MESH_ACTION_FORBIDDEN_TYPE = MESH_ACTION_FORBIDDEN_TYPE;
 exports.MESH_AUTH_MODE_FIELD = require_builtins_system_config_system_config_addon.MESH_AUTH_MODE_FIELD;
 exports.MESH_AUTO_ENFORCE_GRACE_MS = MESH_AUTO_ENFORCE_GRACE_MS;
@@ -27196,6 +27284,13 @@ exports.NotificationService = NotificationService;
 exports.OUTBOUND_QUEUE_COOLDOWN_MS = OUTBOUND_QUEUE_COOLDOWN_MS;
 exports.OUTBOUND_QUEUE_SUSTAIN_MS = OUTBOUND_QUEUE_SUSTAIN_MS;
 exports.OUTBOUND_QUEUE_THRESHOLD_BYTES = OUTBOUND_QUEUE_THRESHOLD_BYTES;
+exports.PAIRING_CODE_DIGITS = require_builtins_system_config_system_config_addon.PAIRING_CODE_DIGITS;
+exports.PAIRING_MAX_CODE_ATTEMPTS = require_builtins_system_config_system_config_addon.PAIRING_MAX_CODE_ATTEMPTS;
+exports.PAIRING_MAX_SESSIONS = require_builtins_system_config_system_config_addon.PAIRING_MAX_SESSIONS;
+exports.PAIRING_PATHS = require_builtins_system_config_system_config_addon.PAIRING_PATHS;
+exports.PAIRING_PIN_DIGITS = require_builtins_system_config_system_config_addon.PAIRING_PIN_DIGITS;
+exports.PAIRING_PROTOCOL = require_builtins_system_config_system_config_addon.PAIRING_PROTOCOL;
+exports.PAIRING_TTL_MS = require_builtins_system_config_system_config_addon.PAIRING_TTL_MS;
 exports.PARENT_ROUTED_PROVIDER_ADDON_ID = PARENT_ROUTED_PROVIDER_ADDON_ID;
 exports.PREVIOUS_LEAF_GRACE_MS = require_builtins_local_auth_local_auth_addon.PREVIOUS_LEAF_GRACE_MS;
 Object.defineProperty(exports, "PYTHON_VERSION", {
@@ -27204,6 +27299,7 @@ Object.defineProperty(exports, "PYTHON_VERSION", {
 		return _camstack_types_node.PYTHON_VERSION;
 	}
 });
+exports.PairingHttpError = require_builtins_system_config_system_config_addon.PairingHttpError;
 exports.PeerAnsweredError = PeerAnsweredError;
 exports.PipelineRunner = PipelineRunner;
 exports.PipelineValidator = PipelineValidator;
@@ -27221,7 +27317,7 @@ exports.ReadinessRegistry = require_dist.ReadinessRegistry;
 exports.ReadinessTimeoutError = require_dist.ReadinessTimeoutError;
 exports.ReplEngine = ReplEngine;
 exports.RingBuffer = RingBuffer;
-exports.SERVER_AUTH_OID = require_tls.SERVER_AUTH_OID;
+exports.SERVER_AUTH_OID = require_agent_https.SERVER_AUTH_OID;
 exports.SOCKET_PLANE_TOP_N = SOCKET_PLANE_TOP_N;
 exports.SOCKET_QUEUE_TOP_N = SOCKET_QUEUE_TOP_N;
 exports.STALL_REPORT_MS = require_custom_action_registry.STALL_REPORT_MS;
@@ -27247,7 +27343,7 @@ exports.TlsTcpTransporter = require_builtins_system_config_system_config_addon.T
 exports.ToastService = ToastService;
 exports.UDS_NO_ROUTE_PREFIX = UDS_NO_ROUTE_PREFIX;
 exports.UNCLAIMED = UNCLAIMED;
-exports.UPLOADED_CA_FILE = require_tls.UPLOADED_CA_FILE;
+exports.UPLOADED_CA_FILE = require_hub_mdns_ciao.UPLOADED_CA_FILE;
 exports.USER_MANAGEMENT_INTERNAL = require_builtins_local_auth_local_auth_addon.USER_MANAGEMENT_INTERNAL;
 exports.UdsLocalTransportClient = UdsLocalTransportClient;
 exports.UdsLocalTransportServer = UdsLocalTransportServer;
@@ -27258,22 +27354,23 @@ exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLogg
 exports.ZERO_LOOP_DELAY = ZERO_LOOP_DELAY;
 exports.__resetCapUsageRegistryForTests = __resetCapUsageRegistryForTests;
 exports.__resetLoggingGateForTests = __resetLoggingGateForTests;
-exports.acceptAgentSans = require_tls.acceptAgentSans;
+exports.acceptAgentSans = require_agent_https.acceptAgentSans;
 exports.adaptBrokerToCluster = adaptBrokerToCluster;
 exports.addonSettingsCapability = require_dist.addonSettingsCapability;
 exports.adoptModelRevisions = require_custom_action_registry.adoptModelRevisions;
 exports.afterWorkerOnlineAnnounce = afterWorkerOnlineAnnounce;
-exports.agentHttpsPaths = require_tls.agentHttpsPaths;
-exports.allFamiliesListenHost = require_tls.allFamiliesListenHost;
+exports.agentHttpsPaths = require_agent_https.agentHttpsPaths;
+exports.allFamiliesListenHost = require_hub_mdns_ciao.allFamiliesListenHost;
 exports.answerClaimedGetStatus = answerClaimedGetStatus;
-exports.applyCertificateToListener = require_tls.applyCertificateToListener;
-exports.applyLanHttp = require_tls.applyLanHttp;
+exports.applyCertificateToListener = require_hub_mdns_ciao.applyCertificateToListener;
+exports.applyLanHttp = require_hub_mdns_ciao.applyLanHttp;
 exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_addon.attachUserManagementInternal;
 exports.attributeStall = require_custom_action_registry.attributeStall;
-exports.bindPendingLanHttp = require_tls.bindPendingLanHttp;
+exports.bindPendingLanHttp = require_hub_mdns_ciao.bindPendingLanHttp;
 exports.bootstrapSchema = bootstrapSchema;
 exports.brokerCallForCap = brokerCallForCap;
 exports.brokerTransportLink = brokerTransportLink;
+exports.buildAgentAnnouncement = buildAgentAnnouncement;
 Object.defineProperty(exports, "buildBinaryPath", {
 	enumerable: true,
 	get: function() {
@@ -27299,21 +27396,23 @@ exports.capActionName = capActionName;
 exports.capActionSuffix = capActionSuffix;
 exports.capBareAction = capBareAction;
 exports.capServiceName = capServiceName;
-exports.certificateNames = require_tls.certificateNames;
+exports.certificateNames = require_agent_https.certificateNames;
 exports.checkClusterSecret = require_constants.checkClusterSecret;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = classifyCapRoute;
-exports.clearHttpsListener = require_tls.clearHttpsListener;
+exports.clearHttpsListener = require_hub_mdns_ciao.clearHttpsListener;
 exports.clearPendingRestart = clearPendingRestart;
 exports.clearPlatformKeychainKey = require_platform_key_source.clearPlatformKeychainKey;
-exports.closeLanHttp = require_tls.closeLanHttp;
+exports.closeLanHttp = require_hub_mdns_ciao.closeLanHttp;
 exports.clusterEventTopic = clusterEventTopic;
 exports.clusterSecretMatches = require_constants.clusterSecretMatches;
-exports.collectAgentNames = require_tls.collectAgentNames;
-exports.collectCertIdentity = require_tls.collectCertIdentity;
+exports.collectAgentNames = require_agent_https.collectAgentNames;
+exports.collectCertIdentity = require_agent_https.collectCertIdentity;
 exports.collectModelFiles = require_custom_action_registry.collectModelFiles;
 exports.computeHubJoinProof = computeHubJoinProof;
 exports.computeNodeJoinProof = computeNodeJoinProof;
+exports.computePairingCommitment = require_builtins_system_config_system_config_addon.computePairingCommitment;
+exports.computePairingSas = require_builtins_system_config_system_config_addon.computePairingSas;
 exports.connectBrokerTransport = connectBrokerTransport;
 exports.contentTypeFor = require_custom_action_registry.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
@@ -27323,13 +27422,14 @@ exports.createAddonDataPlaneFacility = createAddonDataPlaneFacility;
 exports.createAddonPeerBytesFacility = createAddonPeerBytesFacility;
 exports.createAddonService = createAddonService;
 exports.createAgentEventScope = createAgentEventScope;
-exports.createAgentHttpsRequest = require_tls.createAgentHttpsRequest;
+exports.createAgentHttpsRequest = require_agent_https.createAgentHttpsRequest;
 exports.createAgentTransport = createAgentTransport;
 exports.createArrayBufferCensusGate = createArrayBufferCensusGate;
 exports.createAuthenticatedFileServer = require_custom_action_registry.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
 exports.createBrokerDeviceManagerApi = createBrokerDeviceManagerApi;
 exports.createCapActionCensus = createCapActionCensus;
+exports.createCiaoPublisher = require_hub_mdns_ciao.createCiaoPublisher;
 exports.createCidrMatcher = require_builtins_system_config_system_config_addon.createCidrMatcher;
 exports.createCoreCapService = createCoreCapService;
 exports.createDeferredHeapWatchSink = createDeferredHeapWatchSink;
@@ -27367,7 +27467,8 @@ exports.currentBrokerTransporter = currentBrokerTransporter;
 exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
 exports.deleteModelFromDisk = require_custom_action_registry.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
-exports.describeHttpsLeaf = require_tls.describeHttpsLeaf;
+exports.describeCsr = require_builtins_system_config_system_config_addon.describeCsr;
+exports.describeHttpsLeaf = require_agent_https.describeHttpsLeaf;
 exports.describeMeshLeaf = require_builtins_system_config_system_config_addon.describeMeshLeaf;
 exports.describeProviderKindDrift = describeProviderKindDrift;
 exports.describeRss = describeRss;
@@ -27415,8 +27516,8 @@ Object.defineProperty(exports, "ensurePython", {
 		return _camstack_types_node.ensurePython;
 	}
 });
-exports.ensureTlsCert = require_tls.ensureTlsCert;
-exports.evaluateExistingCert = require_tls.evaluateExistingCert;
+exports.ensureTlsCert = require_hub_mdns_ciao.ensureTlsCert;
+exports.evaluateExistingCert = require_agent_https.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.exportMeshPrivateKeyPem = require_builtins_system_config_system_config_addon.exportMeshPrivateKeyPem;
 exports.fetchJson = require_custom_action_registry.fetchJson;
@@ -27459,7 +27560,7 @@ Object.defineProperty(exports, "getPlatformInfo", {
 	}
 });
 exports.getPlatformKeychainKey = require_platform_key_source.getPlatformKeychainKey;
-exports.getProcessAgentHttpsNames = require_agent_https_names.getProcessAgentHttpsNames;
+exports.getProcessAgentHttpsNames = require_agent_https.getProcessAgentHttpsNames;
 exports.getProcessClusterSecretGate = require_constants.getProcessClusterSecretGate;
 exports.getProcessJwtSigningKeyState = require_device_ca.getProcessJwtSigningKeyState;
 exports.getProcessMeshAuthMode = require_builtins_system_config_system_config_addon.getProcessMeshAuthMode;
@@ -27483,8 +27584,9 @@ exports.hasDotNode = hasDotNode;
 exports.hashClusterSecret = require_constants.hashClusterSecret;
 exports.heapSpaceField = heapSpaceField;
 exports.hostNodeIdOf = hostNodeIdOf;
+exports.hubHostFromMeshAddress = require_builtins_system_config_system_config_addon.hubHostFromMeshAddress;
 exports.hubMainRssBudget = hubMainRssBudget;
-exports.installAgentHttps = require_tls.installAgentHttps;
+exports.installAgentHttps = require_agent_https.installAgentHttps;
 exports.installBrokerTransporter = installBrokerTransporter;
 exports.installManifestNativeDeps = installManifestNativeDeps;
 exports.installManifestPythonDeps = installManifestPythonDeps;
@@ -27509,36 +27611,40 @@ exports.isArrayBufferCensusReport = isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isClusterSecretMismatchError = require_constants.isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
-exports.isContainerBridgeAddress = require_tls.isContainerBridgeAddress;
+exports.isContainerBridgeAddress = require_agent_https.isContainerBridgeAddress;
 exports.isCredentialKeyName = isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
 exports.isInstalledTransporter = isInstalledTransporter;
-exports.isLocalOnlyHostname = require_tls.isLocalOnlyHostname;
+exports.isLocalOnlyHostname = require_agent_https.isLocalOnlyHostname;
 exports.isMeshAuthMode = require_builtins_system_config_system_config_addon.isMeshAuthMode;
 exports.isModelDownloaded = require_custom_action_registry.isModelDownloaded;
 exports.isOwnChildNodeId = isOwnChildNodeId;
 exports.isPeerEventPacket = isPeerEventPacket;
-exports.isPrivateAddress = require_tls.isPrivateAddress;
+exports.isPrivateAddress = require_agent_https.isPrivateAddress;
+exports.isProcessVerifiedMeshPeer = require_builtins_system_config_system_config_addon.isProcessVerifiedMeshPeer;
 exports.isRemoteForbiddenAction = isRemoteForbiddenAction;
 exports.isRemoteForbiddenOnAgent = isRemoteForbiddenOnAgent;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
 exports.isSourceNewer = isSourceNewer;
+exports.isValidAgentNodeId = require_builtins_system_config_system_config_addon.isValidAgentNodeId;
 exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
-exports.issueAgentHttpsLeaf = require_tls.issueAgentHttpsLeaf;
+exports.issueAgentHttpsLeaf = require_agent_https.issueAgentHttpsLeaf;
 exports.issueDeviceLeaf = require_device_ca.issueDeviceLeaf;
 exports.issueMeshLeafForNode = require_builtins_system_config_system_config_addon.issueMeshLeafForNode;
 exports.issueMeshLeafFromCsr = require_builtins_system_config_system_config_addon.issueMeshLeafFromCsr;
-exports.leafFingerprintOf = require_tls.leafFingerprintOf;
-exports.loadAgentHttps = require_tls.loadAgentHttps;
+exports.keyFingerprintShort = require_builtins_system_config_system_config_addon.keyFingerprintShort;
+exports.leafFingerprintOf = require_hub_mdns_ciao.leafFingerprintOf;
+exports.loadAgentHttps = require_agent_https.loadAgentHttps;
 exports.loadDeviceCa = require_device_ca.loadDeviceCa;
 exports.loadMeshCa = require_builtins_system_config_system_config_addon.loadMeshCa;
-exports.loadTlsCert = require_tls.loadTlsCert;
+exports.loadTlsCert = require_hub_mdns_ciao.loadTlsCert;
 exports.localEndpointPath = localEndpointPath;
 exports.localProviderLink = localProviderLink;
 exports.localSupportedPythonRuntimes = localSupportedPythonRuntimes;
 exports.mapSignalsToInferenceHardware = mapSignalsToInferenceHardware;
 exports.meshErrorType = meshErrorType;
 exports.mintAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.mintAgentUiUnlockTicket;
+exports.mintAgentUiUnlockTicketEs256 = require_builtins_system_config_system_config_addon.mintAgentUiUnlockTicketEs256;
 exports.mintMeshJoinToken = require_builtins_system_config_system_config_addon.mintMeshJoinToken;
 exports.mountNativeCapService = mountNativeCapService;
 exports.nextRssBudgetState = nextRssBudgetState;
@@ -27555,9 +27661,9 @@ exports.parseRssBudgetMb = parseRssBudgetMb;
 exports.parseTokenExpiry = require_builtins_local_auth_local_auth_addon.parseTokenExpiry;
 exports.parseTokenizedUrl = require_custom_action_registry.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
-exports.pemDigest = require_tls.pemDigest;
-exports.pinnedHttpsCaFingerprint = require_tls.pinnedHttpsCaFingerprint;
-exports.prepareBootTls = require_tls.prepareBootTls;
+exports.pemDigest = require_agent_https.pemDigest;
+exports.pinnedHttpsCaFingerprint = require_agent_https.pinnedHttpsCaFingerprint;
+exports.prepareBootTls = require_hub_mdns_ciao.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
 exports.probePlatform = probePlatform;
 exports.processJoinTokenJtiStore = require_builtins_system_config_system_config_addon.processJoinTokenJtiStore;
@@ -27567,25 +27673,25 @@ exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readBackupEncryptionHeader = require_restore_archive.readBackupEncryptionHeader;
 exports.readCidrSetting = require_builtins_system_config_system_config_addon.readCidrSetting;
-exports.readExtraSans = require_tls.readExtraSans;
+exports.readExtraSans = require_hub_mdns_ciao.readExtraSans;
 exports.readHeapSpaces = readHeapSpaces;
-exports.readLanHttpState = require_tls.readLanHttpState;
+exports.readLanHttpState = require_hub_mdns_ciao.readLanHttpState;
 exports.readPendingRestart = readPendingRestart;
 exports.readSocketQueues = readSocketQueues;
-exports.readTlsAccessStatus = require_tls.readTlsAccessStatus;
-exports.readTlsMode = require_tls.readTlsMode;
+exports.readTlsAccessStatus = require_hub_mdns_ciao.readTlsAccessStatus;
+exports.readTlsMode = require_hub_mdns_ciao.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.reclaimIntervalMs = reclaimIntervalMs;
 exports.recordSocketFrame = recordSocketFrame;
 exports.redactLogEntry = redactLogEntry;
 exports.redactLogMeta = redactLogMeta;
 exports.redactLogText = redactLogText;
-exports.regenerateCertificate = require_tls.regenerateCertificate;
+exports.regenerateCertificate = require_hub_mdns_ciao.regenerateCertificate;
 exports.registerEventBusService = registerEventBusService;
-exports.registerHttpsListener = require_tls.registerHttpsListener;
-exports.registerLanHttpHandler = require_tls.registerLanHttpHandler;
-exports.reissueTlsLeaf = require_tls.reissueTlsLeaf;
-exports.reloadHttpsListener = require_tls.reloadHttpsListener;
+exports.registerHttpsListener = require_hub_mdns_ciao.registerHttpsListener;
+exports.registerLanHttpHandler = require_hub_mdns_ciao.registerLanHttpHandler;
+exports.reissueTlsLeaf = require_hub_mdns_ciao.reissueTlsLeaf;
+exports.reloadHttpsListener = require_hub_mdns_ciao.reloadHttpsListener;
 exports.renewMeshCertificate = require_builtins_system_config_system_config_addon.renewMeshCertificate;
 exports.requestProcessMeshEnforcement = require_builtins_system_config_system_config_addon.requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = require_builtins_system_config_system_config_addon.requireProcessMeshCa;
@@ -27593,7 +27699,7 @@ exports.resolveFilePath = require_custom_action_registry.resolveFilePath;
 exports.resolveFormatRevision = require_custom_action_registry.resolveFormatRevision;
 exports.resolveHwAccel = resolveHwAccel;
 exports.resolveNpmInvocation = resolveNpmInvocation;
-exports.revertToGeneratedCertificate = require_tls.revertToGeneratedCertificate;
+exports.revertToGeneratedCertificate = require_hub_mdns_ciao.revertToGeneratedCertificate;
 exports.revisionWeightUrl = require_custom_action_registry.revisionWeightUrl;
 exports.revokeMeshCertificate = require_builtins_system_config_system_config_addon.revokeMeshCertificate;
 exports.runHubAddonBoot = runHubAddonBoot;
@@ -27606,11 +27712,11 @@ exports.scopesAllowDeviceCap = require_dist.scopesAllowDeviceCap;
 exports.selectAddonResidue = selectAddonResidue;
 exports.selectReportedSpaces = selectReportedSpaces;
 exports.serializeTypedArrays = serializeTypedArrays;
-exports.servedHttpsLeafFingerprint = require_tls.servedHttpsLeafFingerprint;
+exports.servedHttpsLeafFingerprint = require_hub_mdns_ciao.servedHttpsLeafFingerprint;
 exports.setHubConnected = setHubConnected;
 exports.setNodeEventInterest = setNodeEventInterest;
 exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychainKey;
-exports.setProcessAgentHttpsNames = require_agent_https_names.setProcessAgentHttpsNames;
+exports.setProcessAgentHttpsNames = require_agent_https.setProcessAgentHttpsNames;
 exports.setProcessClusterSecretGate = require_constants.setProcessClusterSecretGate;
 exports.setProcessMeshAuthMode = require_builtins_system_config_system_config_addon.setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = require_builtins_system_config_system_config_addon.setProcessMeshAuthStatusSource;
@@ -27621,31 +27727,34 @@ exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_
 exports.setProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.setProcessMeshTlsListenerState;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = shouldReclaim;
+exports.signPairingProof = require_builtins_system_config_system_config_addon.signPairingProof;
 exports.signalAllRunnerGroups = signalAllRunnerGroups;
 exports.socketDirectionBytes = socketDirectionBytes;
 exports.socketDirectionMessages = socketDirectionMessages;
-exports.splitPemCertificates = require_tls.splitPemCertificates;
+exports.splitPemCertificates = require_hub_mdns_ciao.splitPemCertificates;
 exports.stampCallerAddonId = stampCallerAddonId;
 exports.startEventLoopStallMonitor = require_custom_action_registry.startEventLoopStallMonitor;
 exports.startHeapWatch = startHeapWatch;
 exports.startRunnerHeapWatch = startRunnerHeapWatch;
 exports.staticJwtSigningKey = require_device_ca.staticJwtSigningKey;
 exports.storeMayAnswer = storeMayAnswer;
-exports.storeUploadedCertificate = require_tls.storeUploadedCertificate;
+exports.storeUploadedCertificate = require_hub_mdns_ciao.storeUploadedCertificate;
 exports.strandedMb = strandedMb;
 exports.stripCamstackDeps = stripCamstackDeps;
 exports.stripForgedIdentity = stripForgedIdentity;
 exports.stripForwardedCaller = require_builtins_storage_orchestrator_storage_orchestrator_addon.stripForwardedCaller;
 exports.subscribePassthrough = subscribePassthrough;
-exports.systemHostFacts = require_tls.systemHostFacts;
+exports.systemHostFacts = require_agent_https.systemHostFacts;
 exports.udsChildLogToWorkerEntry = udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = validateProviderRegistrations;
-exports.validateUploadedTls = require_tls.validateUploadedTls;
+exports.validateUploadedTls = require_hub_mdns_ciao.validateUploadedTls;
 exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;
+exports.verifyAgentUiUnlockTicketEs256 = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicketEs256;
 exports.verifyDeviceLeaf = require_device_ca.verifyDeviceLeaf;
 exports.verifyDeviceSignature = require_device_ca.verifyDeviceSignature;
 exports.verifyMeshJoinToken = require_builtins_system_config_system_config_addon.verifyMeshJoinToken;
+exports.verifyPairingProof = require_builtins_system_config_system_config_addon.verifyPairingProof;
 exports.waitUntilReady = waitUntilReady;
-exports.writeExtraSans = require_tls.writeExtraSans;
+exports.writeExtraSans = require_hub_mdns_ciao.writeExtraSans;
 exports.writePendingRestart = writePendingRestart;
-exports.writeTlsMode = require_tls.writeTlsMode;
+exports.writeTlsMode = require_hub_mdns_ciao.writeTlsMode;