@camstack/system 1.2.434 → 1.2.436

package/dist/constants-CuOfMdYe.js

@@ -1,221 +0,0 @@
-const require_dist = require("./dist-CCH3XPqO.js");
-let node_crypto = require("node:crypto");
-//#region src/kernel/moleculer/cluster-secret.ts
-/**
-* Cluster-secret registration gate (opt-in). A registering node sends a
-* SHA-256 hash of its cluster secret; the receiver of a `registerNode` RPC
-* verifies it. The raw secret is never transmitted.
-*
-* Where the secret lives (D797) — never in an environment variable:
-*  - the HUB: the keychain, owner `system` ({@link CLUSTER_SECRET_REF}), set
-*    from System → Cluster (a `password` field of `system-config`, whose
-*    `system-settings` row {@link CLUSTER_SECRET_SETTINGS_KEY} holds the
-*    marker). Empty = the gate is off, exactly as a hub without a secret
-*    always was;
-*  - an AGENT: its bootstrap credential, entered at pairing / first run and
-*    kept in its own `agent.json` (0600) — or, in the desktop app, in the OS
-*    keychain — because it needs it before it can reach the hub.
-*/
-/** The keychain ref of the hub's cluster secret: `secret://system/global/clusterSecret`. */
-var CLUSTER_SECRET_REF = require_dist.buildSecretRef({
-	owner: "system",
-	scope: { kind: "global" },
-	fieldPath: "clusterSecret"
-});
-/** The `system-settings` key whose value is the cluster secret's keychain marker. */
-var CLUSTER_SECRET_SETTINGS_KEY = "cluster.clusterSecret";
-/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
-var CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
-/** Process exit code a runner uses when its registration is rejected for a bad secret. */
-var CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
-/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
-function hashClusterSecret(secret) {
-	return (0, node_crypto.createHash)("sha256").update(secret, "utf8").digest("hex");
-}
-/**
-* True if a registration carrying `presentedHash` is allowed against a
-* receiver whose own secret hashes to `expectedHash`.
-* - `expectedHash` undefined → the gate is OFF; everything is allowed.
-* - otherwise `presentedHash` must be present and equal (constant-time).
-*/
-function clusterSecretMatches(expectedHash, presentedHash) {
-	if (expectedHash === void 0) return true;
-	if (presentedHash === void 0 || presentedHash.length !== expectedHash.length) return false;
-	return (0, node_crypto.timingSafeEqual)(Buffer.from(expectedHash), Buffer.from(presentedHash));
-}
-/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
-function isClusterSecretMismatchError(err) {
-	if (typeof err !== "object" || err === null || !("type" in err)) return false;
-	const { type } = err;
-	return type === CLUSTER_SECRET_MISMATCH_TYPE;
-}
-/** Moleculer error `type` of a registration refused because the hub cannot read its own secret yet. */
-var CLUSTER_SECRET_UNAVAILABLE_TYPE = "CLUSTER_SECRET_UNAVAILABLE";
-function checkClusterSecret(gate, presentedHash) {
-	switch (gate.kind) {
-		case "off": return "allow";
-		case "unknown": return "unavailable";
-		case "on": return clusterSecretMatches(gate.hash, presentedHash) ? "allow" : "mismatch";
-	}
-}
-var GATE_SLOT = Symbol.for("camstack.cluster.secret-gate");
-var NOT_LOADED = {
-	kind: "unknown",
-	reason: "not-loaded"
-};
-function isGate(value) {
-	if (value === null || typeof value !== "object") return false;
-	const kind = Reflect.get(value, "kind");
-	if (kind === "off") return true;
-	if (kind === "on") return typeof Reflect.get(value, "hash") === "string";
-	return kind === "unknown" && typeof Reflect.get(value, "reason") === "string";
-}
-/** Register the hub's gate. Called by `system-config`, which owns the field. */
-function setProcessClusterSecretGate(gate) {
-	Reflect.set(globalThis, GATE_SLOT, gate);
-}
-/** The hub's gate; `unknown` until `system-config` loaded it. */
-function getProcessClusterSecretGate() {
-	const value = Reflect.get(globalThis, GATE_SLOT);
-	return isGate(value) ? value : NOT_LOADED;
-}
-/** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require_dist.buildSecretRef({
-	owner: "system",
-	scope: { kind: "global" },
-	fieldPath: "meshCaKey"
-});
-/** `system-settings` key holding the public CA certificate PEM. */
-var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
-/** Field inside the `cluster` section. */
-var MESH_CA_FIELD = "meshCa";
-/** Join-token / leaf lifetimes. */
-var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
-var MESH_CA_VALIDITY_DAYS = 3650;
-var DEFAULT_HUB_TLS_TCP_PORT = 6443;
-/** Subject of the mesh root. Distinct from the HTTPS local CA. */
-var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
-/** Client + server auth EKU OIDs (mutual TLS). */
-var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
-//#endregion
-Object.defineProperty(exports, "CLIENT_AUTH_OID", {
-	enumerable: true,
-	get: function() {
-		return CLIENT_AUTH_OID;
-	}
-});
-Object.defineProperty(exports, "CLUSTER_SECRET_MISMATCH_TYPE", {
-	enumerable: true,
-	get: function() {
-		return CLUSTER_SECRET_MISMATCH_TYPE;
-	}
-});
-Object.defineProperty(exports, "CLUSTER_SECRET_REF", {
-	enumerable: true,
-	get: function() {
-		return CLUSTER_SECRET_REF;
-	}
-});
-Object.defineProperty(exports, "CLUSTER_SECRET_REJECTED_EXIT_CODE", {
-	enumerable: true,
-	get: function() {
-		return CLUSTER_SECRET_REJECTED_EXIT_CODE;
-	}
-});
-Object.defineProperty(exports, "CLUSTER_SECRET_SETTINGS_KEY", {
-	enumerable: true,
-	get: function() {
-		return CLUSTER_SECRET_SETTINGS_KEY;
-	}
-});
-Object.defineProperty(exports, "CLUSTER_SECRET_UNAVAILABLE_TYPE", {
-	enumerable: true,
-	get: function() {
-		return CLUSTER_SECRET_UNAVAILABLE_TYPE;
-	}
-});
-Object.defineProperty(exports, "DEFAULT_HUB_TLS_TCP_PORT", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_HUB_TLS_TCP_PORT;
-	}
-});
-Object.defineProperty(exports, "MESH_CA_COMMON_NAME", {
-	enumerable: true,
-	get: function() {
-		return MESH_CA_COMMON_NAME;
-	}
-});
-Object.defineProperty(exports, "MESH_CA_FIELD", {
-	enumerable: true,
-	get: function() {
-		return MESH_CA_FIELD;
-	}
-});
-Object.defineProperty(exports, "MESH_CA_KEY_REF", {
-	enumerable: true,
-	get: function() {
-		return MESH_CA_KEY_REF;
-	}
-});
-Object.defineProperty(exports, "MESH_CA_SETTINGS_KEY", {
-	enumerable: true,
-	get: function() {
-		return MESH_CA_SETTINGS_KEY;
-	}
-});
-Object.defineProperty(exports, "MESH_CA_VALIDITY_DAYS", {
-	enumerable: true,
-	get: function() {
-		return MESH_CA_VALIDITY_DAYS;
-	}
-});
-Object.defineProperty(exports, "MESH_JOIN_TOKEN_MAX_TTL_SEC", {
-	enumerable: true,
-	get: function() {
-		return MESH_JOIN_TOKEN_MAX_TTL_SEC;
-	}
-});
-Object.defineProperty(exports, "SERVER_AUTH_OID", {
-	enumerable: true,
-	get: function() {
-		return SERVER_AUTH_OID;
-	}
-});
-Object.defineProperty(exports, "checkClusterSecret", {
-	enumerable: true,
-	get: function() {
-		return checkClusterSecret;
-	}
-});
-Object.defineProperty(exports, "clusterSecretMatches", {
-	enumerable: true,
-	get: function() {
-		return clusterSecretMatches;
-	}
-});
-Object.defineProperty(exports, "getProcessClusterSecretGate", {
-	enumerable: true,
-	get: function() {
-		return getProcessClusterSecretGate;
-	}
-});
-Object.defineProperty(exports, "hashClusterSecret", {
-	enumerable: true,
-	get: function() {
-		return hashClusterSecret;
-	}
-});
-Object.defineProperty(exports, "isClusterSecretMismatchError", {
-	enumerable: true,
-	get: function() {
-		return isClusterSecretMismatchError;
-	}
-});
-Object.defineProperty(exports, "setProcessClusterSecretGate", {
-	enumerable: true,
-	get: function() {
-		return setProcessClusterSecretGate;
-	}
-});

package/dist/kernel/moleculer/agent-mesh-authenticator.d.ts

@@ -1,91 +0,0 @@
-/**
-* AgentMeshAuthenticator — which peer may call THIS agent over the mesh
-* (D802 residual: agent inbound).
-*
-* The hub gate (`MeshAuthenticator`) is the other half of the same
-* containment. An agent reuses {@link createMeshAccessMiddleware} with this
-* admit policy:
-*
-*  1. **Hub.** Marked `authenticated` when {@link MeshJoinClient} settles a
-*     mutual challenge–response (`noteHubJoinState`). Forgotten on disconnect.
-*  2. **Own children** (`${ownNodeId}/…`). May call `$agent.registerNode`
-*     before they are authenticated (that call IS the proof — the handler
-*     checks the cluster-secret hash). A successful register marks them
-*     authenticated until disconnect.
-*  3. **Everyone else.** Refused in `enforced`, tolerated (with a warning
-*     hook) in `transition`. Mode is `enforced` when this agent holds a
-*     cluster secret, `transition` when it does not — so an upgrading agent
-*     without a secret still serves the hub.
-*
-* The hub's requests that arrive while a join is in flight are HELD, not
-* refused (D848 §3, {@link MeshJoinHold}): delivered when the join proves the
-* hub, refused and reported when it fails or the bound runs out.
-*
-* Unlike the hub gate, `$process.*` is allowed from an authenticated hub:
-* the hub polls `$process.list` on agents. `$node.*` stays forbidden from
-* every remote peer. Forged `caller` / `callerAddonId` are stripped by the
-* shared middleware.
-*
-* Spoofing of a declared node id on clear-text Moleculer remains until mTLS
-* (`docs/design/2026-10-09-mesh-mtls-plan.md`) — same residual as the hub.
-*/
-import type { MeshAuthMode, MeshNodeAuthState } from "./mesh-auth-mode.js";
-import type { MeshJoinState } from "./mesh-join-client.js";
-import { type MeshGateVerdict, type MeshJoinHoldReport } from "./mesh-join-hold.js";
-/** The child's register action on its parent agent. */
-export declare const AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
-export declare function isRemoteForbiddenOnAgent(action: string): boolean;
-export declare function isOwnChildNodeId(ownNodeId: string, sender: string): boolean;
-export interface AgentMeshAuthenticatorDeps {
-	readonly ownNodeId: string;
-	readonly hubNodeId?: string;
-	/** True when `agent.json` holds a cluster secret. */
-	readonly hasSecret: () => boolean;
-	/**
-	* D857 (transition release): the hub is accepted when its mutual-TLS leaf chained to the CA
-	* this agent pinned, its CN is the hub's node id and it is not revoked — in ADDITION to the
-	* mutual join. A hub that no longer answers the join (the removal release) is served at once.
-	*/
-	readonly isVerifiedPeer?: (nodeId: string) => boolean;
-	/**
-	* True when `agent.json` holds mesh material. A paired agent is `enforced` even with no cluster
-	* secret (D857): without this, an agent paired by certificate would tolerate strangers.
-	*/
-	readonly isPaired?: () => boolean;
-	readonly now?: () => number;
-	/** First time a peer is tolerated without proof on this connection. */
-	readonly onTolerated?: (nodeId: string, action: string) => void;
-	/** Every decision about the hub's requests held before the join settled. */
-	readonly onHoldReport?: (report: MeshJoinHoldReport) => void;
-	/** Bounds of that hold (defaults: 1000 items, 15 s). */
-	readonly maxHeld?: number;
-	readonly maxHoldMs?: number;
-}
-export declare class AgentMeshAuthenticator {
-	private readonly deps;
-	private readonly nodes;
-	private readonly hubNodeId;
-	private readonly now;
-	private readonly hold;
-	constructor(deps: AgentMeshAuthenticatorDeps);
-	/** How many of the hub's requests wait for the join right now. */
-	heldCount(): number;
-	/** Current mode: a secret OR a certificate → enforce; else tolerate (upgrade path). */
-	mode(): MeshAuthMode;
-	/**
-	* Reflect a settled mesh join. `authenticated` stamps the hub; a blocking
-	* failure forgets it so an impostor cannot call in; transitional states
-	* leave the hub unmarked (calls are tolerated while mode is `transition`).
-	*/
-	noteHubJoinState(state: MeshJoinState): void;
-	/** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
-	noteChildRegistered(sender: string, proof?: "authenticated" | "legacy"): void;
-	/** The peer's connection dropped. */
-	forget(nodeId: string): void;
-	admitCall(sender: string, action: string): MeshGateVerdict;
-	admitEvent(sender: string, eventName: string): MeshGateVerdict;
-	stateOf(nodeId: string): MeshNodeAuthState;
-	authenticatedNodeIds(): readonly string[];
-	private admitSender;
-	private record;
-}

package/dist/kernel/moleculer/cluster-secret.d.ts

@@ -1,46 +0,0 @@
-/** The keychain ref of the hub's cluster secret: `secret://system/global/clusterSecret`. */
-export declare const CLUSTER_SECRET_REF: string;
-/** The `system-settings` key whose value is the cluster secret's keychain marker. */
-export declare const CLUSTER_SECRET_SETTINGS_KEY = "cluster.clusterSecret";
-/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
-export declare const CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
-/** Process exit code a runner uses when its registration is rejected for a bad secret. */
-export declare const CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
-/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
-export declare function hashClusterSecret(secret: string): string;
-/**
-* True if a registration carrying `presentedHash` is allowed against a
-* receiver whose own secret hashes to `expectedHash`.
-* - `expectedHash` undefined → the gate is OFF; everything is allowed.
-* - otherwise `presentedHash` must be present and equal (constant-time).
-*/
-export declare function clusterSecretMatches(expectedHash: string | undefined, presentedHash: string | undefined): boolean;
-/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
-export declare function isClusterSecretMismatchError(err: unknown): boolean;
-/** Moleculer error `type` of a registration refused because the hub cannot read its own secret yet. */
-export declare const CLUSTER_SECRET_UNAVAILABLE_TYPE = "CLUSTER_SECRET_UNAVAILABLE";
-/**
-* What the hub knows about its own cluster secret:
-*  - `off`: none is set — every node may register (the behaviour of a hub
-*    that never had a secret);
-*  - `on`: set — a node must present the matching hash;
-*  - `unknown`: one is set (the marker exists) but the keychain cannot answer
-*    yet — registrations are refused with a RETRYABLE error until it does.
-*    Fail closed: a locked keychain never opens the gate.
-*/
-export type ClusterSecretGate = {
-	readonly kind: "off";
-} | {
-	readonly kind: "on";
-	readonly hash: string;
-} | {
-	readonly kind: "unknown";
-	readonly reason: string;
-};
-export type ClusterSecretVerdict = "allow" | "mismatch" | "unavailable";
-export declare function checkClusterSecret(gate: ClusterSecretGate, presentedHash: string | undefined): ClusterSecretVerdict;
-/** Register the hub's gate. Called by `system-config`, which owns the field. */
-export declare function setProcessClusterSecretGate(gate: ClusterSecretGate): void;
-export declare function clearProcessClusterSecretGate(): void;
-/** The hub's gate; `unknown` until `system-config` loaded it. */
-export declare function getProcessClusterSecretGate(): ClusterSecretGate;

package/dist/kernel/moleculer/mesh-auth-mode.d.ts

@@ -1,58 +0,0 @@
-/**
-* How strictly the hub holds other nodes to the mesh join (D802).
-*
-*  - `transition`: a node that has not authenticated is TOLERATED — its calls
-*    run, a warning names it, and System → Cluster lists it as "not
-*    authenticated". This is how an existing cluster upgrades without
-*    splitting: the hub generates its secret, the operator copies it into each
-*    agent, and nothing is refused meanwhile.
-*  - `enforced`: a node that has not authenticated is refused on every action
-*    and its events are dropped. The D797 hash in `registerNode` is no longer
-*    accepted either — only the challenge–response.
-*
-* `transition` ends by itself once EVERY node the hub has ever seen (the
-* cluster-node history) has authenticated with the challenge–response
-* (`MeshAuthenticator.onAuthenticated` → `requestProcessMeshEnforcement`).
-* The operator can also switch it in System → Cluster, in both directions.
-*
-* The mode lives in the `cluster` section of `system-settings`
-* (`cluster.meshAuth`), owned by `system-config`, published here as a process
-* slot the hub's broker reads on every call — the same pattern as the cluster
-* secret gate (`cluster-secret.ts`).
-*/
-export type MeshAuthMode = "transition" | "enforced";
-/** The field key inside the `cluster` section. */
-export declare const MESH_AUTH_MODE_FIELD = "meshAuth";
-export declare function isMeshAuthMode(value: unknown): value is MeshAuthMode;
-/** A stored value that is not a mode reads as `transition`: never refuse on a typo. */
-export declare function parseMeshAuthMode(value: unknown): MeshAuthMode;
-/** How a node stands with the hub right now. */
-export type MeshNodeAuthState = "authenticated" | "legacy" | "unauthenticated";
-export interface MeshNodeAuthEntry {
-	readonly nodeId: string;
-	readonly state: MeshNodeAuthState;
-	/** Epoch ms of the last change. */
-	readonly since: number;
-}
-/** What System → Cluster shows. */
-export interface MeshAuthStatus {
-	readonly mode: MeshAuthMode;
-	readonly nodes: readonly MeshNodeAuthEntry[];
-}
-/** Published by `system-config` whenever the stored mode is (re)read. */
-export declare function setProcessMeshAuthMode(mode: MeshAuthMode): void;
-/**
-* The hub's mode. Until `system-config` has read it: `transition` — the safe
-* side for an upgrading cluster (nothing that worked before is refused), and
-* exactly what an unread setting means.
-*/
-export declare function getProcessMeshAuthMode(): MeshAuthMode;
-export declare function clearProcessMeshAuthMode(): void;
-/** Persists `enforced`; installed by `system-config`, which owns the setting. */
-export type MeshEnforcer = (reason: string) => Promise<void>;
-export declare function setProcessMeshEnforcer(enforcer: MeshEnforcer | null): void;
-/** Ask the owner of the setting to switch to `enforced`. `false` when nobody can. */
-export declare function requestProcessMeshEnforcement(reason: string): Promise<boolean>;
-/** Published by the hub's broker; read by System → Cluster. */
-export declare function setProcessMeshAuthStatusSource(source: (() => MeshAuthStatus) | null): void;
-export declare function getProcessMeshAuthStatus(): MeshAuthStatus | null;

package/dist/kernel/moleculer/mesh-authenticator.d.ts

@@ -1,77 +0,0 @@
-import { type ClusterSecretGate } from "./cluster-secret.js";
-import type { MeshAuthMode, MeshAuthStatus, MeshNodeAuthState } from "./mesh-auth-mode.js";
-import { type MeshJoinAuthenticateParams, type MeshJoinAuthenticateResult, type MeshJoinChallenge } from "./mesh-join-proof.js";
-/** A challenge is answered within this window or not at all. */
-export declare const MESH_JOIN_CHALLENGE_TTL_MS = 6e4;
-export declare function isRemoteForbiddenAction(action: string): boolean;
-export type MeshCallVerdict = {
-	readonly verdict: "allow";
-	readonly errorType?: undefined;
-} | {
-	readonly verdict: "tolerate";
-	readonly errorType?: undefined;
-} | {
-	readonly verdict: "deny";
-	readonly errorType: string;
-	readonly message: string;
-};
-export interface MeshAuthenticatorDeps {
-	/** The hub's own node id — its local calls never pass through here. */
-	readonly ownNodeId: string;
-	/** The cluster secret as the keychain answers it now (D797). */
-	readonly gate: () => ClusterSecretGate;
-	readonly mode: () => MeshAuthMode;
-	/**
-	* D857 (transition release): a node whose mutual-TLS handshake chained to the mesh CA, whose CN
-	* is its node id and whose leaf is not revoked is admitted WITHOUT the challenge–response. The
-	* join stays answered for agents that still need it.
-	*/
-	readonly isVerifiedPeer?: (nodeId: string) => boolean;
-	readonly now?: () => number;
-	/** A node completed the challenge–response. */
-	readonly onAuthenticated?: (nodeId: string) => void;
-	/** First time a node is tolerated without proof on this connection. */
-	readonly onTolerated?: (nodeId: string, action: string) => void;
-}
-interface RegistrationLike {
-	readonly nodeId: string;
-	readonly clusterSecretHash?: string;
-}
-export declare class MeshAuthenticator {
-	private readonly deps;
-	private readonly challenges;
-	private readonly nodes;
-	/** Completed the challenge–response at least once since the hub started. */
-	private readonly everAuthenticated;
-	/** Let in WITHOUT the challenge–response at least once since the hub started. */
-	private readonly everTolerated;
-	private readonly now;
-	constructor(deps: MeshAuthenticatorDeps);
-	issueChallenge(sender: string): MeshJoinChallenge;
-	authenticate(sender: string, params: MeshJoinAuthenticateParams): MeshJoinAuthenticateResult;
-	/** The node's connection dropped: it authenticates again when it returns. */
-	forget(nodeId: string): void;
-	admitCall(sender: string, action: string): MeshCallVerdict;
-	/** Same rule as a call, for an inbound event. */
-	admitEvent(sender: string, eventName: string): MeshCallVerdict;
-	private admitSender;
-	/** Throws when `sender` may not register `params`; returns when it may. */
-	admitRegistration(sender: string, params: RegistrationLike): void;
-	private noteTolerated;
-	stateOf(nodeId: string): MeshNodeAuthState;
-	/** Node ids that completed the challenge–response on their current connection. */
-	authenticatedNodeIds(): readonly string[];
-	/** Node ids that ever completed the challenge–response since the hub started. */
-	everAuthenticatedNodeIds(): ReadonlySet<string>;
-	/**
-	* Node ids let in without the challenge–response since the hub started.
-	* Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
-	* and the ones already here keep the transition open (the operator can still
-	* switch to `enforced` by hand).
-	*/
-	everToleratedNodeIds(): readonly string[];
-	snapshot(): MeshAuthStatus;
-	private record;
-	private secretHashOrThrow;
-}
-export {};

package/dist/kernel/moleculer/mesh-auto-enforce.d.ts

@@ -1,46 +0,0 @@
-/**
-* When `transition` may end by itself (D802).
-*
-* The rule the operator chose: enforce once EVERY known agent has presented
-* the secret. "Known" is deliberately wide, so the switch can never cut off an
-* agent the hub merely forgot about:
-*  - every node in the durable cluster-node history (offline ones included —
-*    an agent that is down today still holds no secret tomorrow);
-*  - every node connected right now;
-*  - every node tolerated without proof since the hub started.
-*
-* and it waits:
-*  - for the history to ANSWER (an unanswered read is never "no agents");
-*  - for a grace period after boot, so agents restarting with the hub are
-*    back before an empty roster is taken at its word;
-*  - for the secret to exist (`on`) — nothing can authenticate without it.
-*
-* "Presented" means completed the challenge–response at least once since the
-* hub started. The D797 hash does not count: it is what `enforced` refuses.
-*/
-import type { ClusterSecretGate } from "./cluster-secret.js";
-import type { MeshAuthMode } from "./mesh-auth-mode.js";
-/** Boot grace before an empty or partial roster can end the transition. */
-export declare const MESH_AUTO_ENFORCE_GRACE_MS: number;
-export interface MeshAutoEnforceInput {
-	readonly mode: MeshAuthMode;
-	readonly gate: ClusterSecretGate["kind"];
-	readonly uptimeMs: number;
-	readonly graceMs?: number;
-	/** Agent node ids from the cluster-node history; `null` = the store did not answer. */
-	readonly knownAgents: readonly string[] | null;
-	readonly connected: readonly string[];
-	readonly toleratedEver: readonly string[];
-	readonly authenticatedEver: ReadonlySet<string>;
-	/** The hub's own id and its local children (`hub/<runner>`) are not agents. */
-	readonly ownNodeId: string;
-}
-export type MeshAutoEnforceDecision = {
-	readonly enforce: true;
-	readonly reason: string;
-} | {
-	readonly enforce: false;
-	readonly waitingFor: readonly string[];
-	readonly why: string;
-};
-export declare function decideMeshAutoEnforce(input: MeshAutoEnforceInput): MeshAutoEnforceDecision;

package/dist/kernel/moleculer/mesh-join-client.d.ts

@@ -1,73 +0,0 @@
-/**
-* MeshJoinClient — the agent half of the mesh join (D802).
-*
-* On every connection to the hub the agent runs the challenge–response
-* (`mesh-join-proof.ts`) BEFORE anything else reaches the hub: the broker
-* middleware from {@link MeshJoinClient.middleware} holds every call to the
-* hub node until the join has settled. The agent also checks the hub's proof,
-* so a node answering to `hub` without the secret is refused.
-*
-* Settled states, and what a call to the hub does in each:
-*  - `authenticated` — mutual proof done → calls flow;
-*  - `no-secret`     — this agent holds no secret → calls flow and the hub
-*                      decides (tolerated in `transition`, refused in
-*                      `enforced`);
-*  - `unsupported`   — the hub predates D802 → calls flow; the agent falls
-*                      back to the D797 hash in `registerNode` (one release);
-*  - `unavailable`   — the hub cannot read its secret yet, or did not answer
-*                      → calls flow (the hub decides) and the owner retries
-*                      the join;
-*  - `secret-mismatch` — the hub refused our proof → calls are REJECTED;
-*  - `hub-unverified`  — the hub could not prove the secret → REJECTED.
-*/
-import type { Middleware } from "moleculer";
-export type MeshJoinState = "pending" | "authenticated" | "no-secret" | "unsupported" | "unavailable" | "secret-mismatch" | "hub-unverified";
-export type MeshJoinCall = (action: string, params: unknown, opts?: {
-	nodeID?: string;
-	timeout?: number;
-}) => Promise<unknown>;
-export interface MeshJoinClientOptions {
-	readonly nodeId: string;
-	/** The agent's cluster secret, read at each join (the operator may enter it at runtime). */
-	readonly secret: () => string | null;
-	readonly call: MeshJoinCall;
-	readonly hubNodeId?: string;
-	readonly maxAttempts?: number;
-	readonly retryDelayMs?: number;
-	readonly callTimeoutMs?: number;
-	/** How long a call waits for a pending join before it fails (default 30 s). */
-	readonly pendingWaitMs?: number;
-	readonly log?: (message: string) => void;
-	/** Told about every settled state. */
-	readonly onSettled?: (state: MeshJoinState) => void;
-}
-export declare class MeshJoinClient {
-	private readonly opts;
-	private current;
-	private settledWaiters;
-	private inFlight;
-	private readonly hubNodeId;
-	constructor(opts: MeshJoinClientOptions);
-	get state(): MeshJoinState;
-	/** Did this agent prove itself on the current connection? */
-	get authenticated(): boolean;
-	/**
-	* Run the join. Concurrent callers share one attempt. Resolves with the
-	* settled state; never rejects.
-	*/
-	join(): Promise<MeshJoinState>;
-	/** The hub connection dropped: the next connection authenticates again. */
-	reset(): void;
-	/** Resolves when a call to the hub may go out; rejects when it must not. */
-	whenCallable(): Promise<void>;
-	/**
-	* Moleculer middleware for the AGENT broker: every call to the hub node waits
-	* for the join; a hub answer "not authenticated" (the hub restarted and lost
-	* us) triggers a new join.
-	*/
-	middleware(onUnauthenticated?: () => void): Middleware;
-	private secretPresent;
-	private settle;
-	private runJoin;
-	private attempt;
-}