@camstack/system 1.2.435 → 1.2.436

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $ as addonSettingsCapability, $t as isObjectInput, Bn as scopesAllowDeviceCap, Br as emitDownForOwnedCaps, Cr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Dr as ReadinessRegistry, En as procedureAuthKey, Er as RUNTIME_DEFAULTS, F as LOG_LEVEL_RANK, Hr as expandCapMethods, Ht as extractNestedAddonId, In as resolveMethodAuth, L as METHOD_ACCESS_MAP, Lr as createEvent$1, Mr as asNumber, Nr as asString$1, Or as ReadinessTimeoutError, Sr as DATAPLANE_SECRET_HEADER$1, Xt as isCollectionArrayMethod, Yt as isArrayOutputSchema, Zn as supportedRuntimes, bn as objectInputDeclaresAddonId, br as errMsg$1, dn as looseSchema, ei as parseJsonObject, en as isVoidInput, ii as resolveCapMount, jr as asJsonObject$1, n as AGENT_MDNS_TXT_KEYS, oi as scopeKey, on as lifecycleJobSchema, pi as EventCategory$1, r as ALL_CAPABILITY_DEFINITIONS, ri as readinessKey, t as AGENT_MDNS_SERVICE_TYPE, ti as parseJsonUnknown, tn as kebabToCamel$1, un as logLevelAtMost, wr as DEVICE_STATUS_METHOD, xn as objectInputDeclaresRequiredDeviceId, zn as scopesAllowAddon } from "./dist-Bz4_y8Xy.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-B6YJZus6.mjs";
+import { $ as addonSettingsCapability, $r as parseJsonObject, $t as isObjectInput, Bn as scopesAllowDeviceCap, Br as emitDownForOwnedCaps, Cr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Dr as ReadinessRegistry, En as procedureAuthKey, Er as RUNTIME_DEFAULTS, F as LOG_LEVEL_RANK, Hr as expandCapMethods, Ht as extractNestedAddonId, In as resolveMethodAuth, L as METHOD_ACCESS_MAP, Lr as createEvent$1, Mr as asNumber, Nr as asString$1, Or as ReadinessTimeoutError, Sr as DATAPLANE_SECRET_HEADER$1, Xt as isCollectionArrayMethod, Yt as isArrayOutputSchema, Zn as supportedRuntimes, ai as scopeKey, bn as objectInputDeclaresAddonId, br as errMsg$1, di as EventCategory$1, dn as looseSchema, ei as parseJsonUnknown, en as isVoidInput, jr as asJsonObject$1, n as AGENT_MDNS_TXT_KEYS, ni as readinessKey, on as lifecycleJobSchema, r as ALL_CAPABILITY_DEFINITIONS, ri as resolveCapMount, t as AGENT_MDNS_SERVICE_TYPE, tn as kebabToCamel$1, un as logLevelAtMost, wr as DEVICE_STATUS_METHOD, xn as objectInputDeclaresRequiredDeviceId, zn as scopesAllowAddon } from "./dist-DjD2M79P.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-BNM5ai4t.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,24 +21,24 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-DLrbapzi.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-CaDsrJM_.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-B8lKYVtU.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-DoiTA134.mjs";
-import { $ as requireProcessMeshCa, A as dropProcessPeer, At as setProcessMeshAuthStatusSource, B as openMeshTlsWhenRevocationsLoaded, C as Transporters, Ct as MESH_AUTH_MODE_FIELD, D as mintMeshJoinToken, Dt as parseMeshAuthMode, E as JoinTokenJtiStore, Et as isMeshAuthMode, F as onProcessNodeRegistered, Ft as readCidrSetting, G as RENEWAL_ABANDONED, H as MESH_NODE_CERTIFICATES_COLLECTION, I as setProcessMeshPeerTransportLookup, J as setProcessMeshCertificateRegistry, K as describeMeshLeaf, L as renewMeshCertificate, M as getProcessNodeMeshTransport, Mt as createCidrMatcher, N as getProcessPeerLeaf, Nt as normalizeIp, O as processJoinTokenJtiStore, Ot as requestProcessMeshEnforcement, P as isProcessVerifiedMeshPeer, Pt as parseCidrList, Q as getProcessMeshCaState, R as revokeMeshCertificate, S as ServiceBroker, St as verifyAgentUiUnlockTicketEs256, SystemConfigAddon, T as enrollMeshNode, Tt as getProcessMeshAuthStatus, U as MESH_NODE_CERTIFICATES_COLUMNS, V as setProcessMeshTlsListenerState, W as MeshCertificateRegistry, X as processMeshCrl, Y as MeshCrl, Z as MeshCaKeeper, _ as signPairingProof, _t as isAllowedAgentDashboardReturnTo, a as hubHostFromMeshAddress, at as generateMeshKeyPair, b as TlsTcpTransporter, bt as parseAgentDashboardOrigins, c as PAIRING_MAX_SESSIONS, ct as issueMeshLeafFromCsr, d as PAIRING_PROTOCOL, dt as AGENT_UI_UNLOCK_DOMAIN, et as caFingerprint, f as PAIRING_TTL_MS, ft as AGENT_UI_UNLOCK_TTL_MS, g as keyFingerprintShort, gt as UnlockTicketJtiStore, h as describeCsr, ht as AGENT_UI_UNLOCK_VERSION, i as AgentPairing, it as generateMeshCa, j as emitProcessNodeRegistered, jt as setProcessMeshEnforcer, k as verifyMeshJoinToken, kt as setProcessMeshAuthMode, l as PAIRING_PATHS, lt as loadMeshCa, m as computePairingSas, mt as AGENT_UI_UNLOCK_USE, n as HubPairing, nt as createMeshCsrPem, o as PAIRING_CODE_DIGITS, ot as isValidAgentNodeId, p as computePairingCommitment, pt as AGENT_UI_UNLOCK_TYP, q as getProcessMeshCertificateRegistry, r as PairingHttpError, rt as exportMeshPrivateKeyPem, s as PAIRING_MAX_CODE_ATTEMPTS, st as issueMeshLeafForNode, tt as caFingerprintCompact, u as PAIRING_PIN_DIGITS, ut as AGENT_DASHBOARD_ORIGINS_FIELD, v as verifyPairingProof, vt as mintAgentUiUnlockTicket, w as setProcessMeshTlsEnabler, wt as getProcessMeshAuthMode, x as Errors, xt as verifyAgentUiUnlockTicket, y as MESH_TLS_PORT_HELLO_FIELD, yt as mintAgentUiUnlockTicketEs256, z as getProcessMeshTlsListenerState } from "./builtins/system-config/system-config.addon.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-BFpowodq.mjs";
+import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
 import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DJRwtlA8.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DJYuznWP.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-BxmP1ChO.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureBinary as ensureBinary$1, ensureFfmpeg, ensureFfmpeg as ensureFfmpeg$1, ensurePython, ensurePython as ensurePython$1, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonPackages as installPythonPackages$1, installPythonRequirements, installPythonRequirements as installPythonRequirements$1 } from "@camstack/types/node";
 import { connect, createConnection, createServer } from "node:net";
 import { mkdir, rm, stat, unlink } from "node:fs/promises";
@@ -15180,11 +15180,10 @@ function createBroker(config) {
 		},
 		metrics: metricsConfig
 	});
-	const transport = createAgentTransport(config);
 	return new ServiceBroker({
 		nodeID,
 		serializer: "MsgPack",
-		transporter: transport.kind === "tls" ? transport.transporter : transport.descriptor,
+		transporter: createAgentTransport(config).transporter,
 		...config.middlewares !== void 0 ? { middlewares: [...config.middlewares] } : {},
 		logger: {
 			type: "Console",
@@ -15219,37 +15218,21 @@ function createAgentTransport(config) {
 	const useHostname = resolveUseHostname();
 	const agentListenPort = config.agentListenPort ?? deriveAgentListenPort(nodeID);
 	const hubDialPort = config.meshTls !== void 0 ? config.tlsPort ?? 6443 : tcpPort;
-	if (config.meshTls !== void 0) {
-		const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
-		return {
-			kind: "tls",
-			transporter: new TlsTcpTransporter({
-				port: agentListenPort,
-				tlsPort: config.agentTlsListenPort ?? 6443,
-				peerTlsPort: hubDialPort,
-				hubOnlyPeers: true,
-				maxPacketSize: 10 * 1024 * 1024,
-				useHostname,
-				debug: false,
-				meshTls: config.meshTls,
-				udpDiscovery: false,
-				...urls !== void 0 ? { urls } : {}
-			})
-		};
-	}
+	const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
 	return {
-		kind: "tcp",
-		descriptor: {
-			type: "TCP",
-			options: {
-				maxPacketSize: 10 * 1024 * 1024,
-				port: agentListenPort,
-				useHostname,
-				debug: false,
-				udpDiscovery: false,
-				...hubAddress ? { urls: normalizeHubUrl(hubAddress, tcpPort) } : {}
-			}
-		}
+		kind: "tls",
+		transporter: new TlsTcpTransporter({
+			port: agentListenPort,
+			tlsPort: config.agentTlsListenPort ?? 6443,
+			peerTlsPort: hubDialPort,
+			hubOnlyPeers: true,
+			maxPacketSize: 10 * 1024 * 1024,
+			useHostname,
+			debug: false,
+			...config.meshTls !== void 0 ? { meshTls: config.meshTls } : {},
+			udpDiscovery: false,
+			...urls !== void 0 ? { urls } : {}
+		})
 	};
 }
 function normalizeHubUrl(raw, defaultPort) {
@@ -15268,23 +15251,6 @@ function getBrokerTlsTransporter(broker) {
 }
 //#endregion
 //#region src/kernel/moleculer/broker-transport-swap.ts
-/**
-* Reconnecting a broker's TRANSPORT in place, without rebuilding the broker (D856 amendment).
-*
-* An agent changes how it dials the hub (a new hub address, a new cluster secret, a mesh leaf
-* swap or its rollback) by replacing its transporter. It used to stop the whole `ServiceBroker`
-* and build another. That threw away everything bound to the old one: the `$process` service
-* (whose `stopped()` SIGTERMs every runner - the "child gone" lines), `$agent-cap-fwd`,
-* `$agent`, the event bus, the addon services and every closure that captured the broker. The
-* node came back ONLINE and capless, and the hub's confirm step then failed with
-* "`$agent-cap-fwd.forward` is not found".
-*
-* The broker, its services, its registries and its child runners are all independent of the
-* wire. So only the wire is replaced: disconnect the transit, forget the remote nodes (their
-* connection is gone, and the next `$node.connected` is what re-runs the mesh join), install a
-* new transporter on the SAME transit and connect it. Children never notice; the join's settle
-* re-sends the full manifest (D3), which still carries every child.
-*/
 function isObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -15319,7 +15285,7 @@ function currentBrokerTransporter(broker) {
 }
 /** Build the transporter an {@link AgentTransport} describes (nothing is bound or dialled yet). */
 function buildTransporter(transport) {
-	const tx = transport.kind === "tls" ? transport.transporter : Transporters.resolve(transport.descriptor);
+	const tx = transport.transporter;
 	if (!isTransporterLike(tx)) throw new Error("the agent transport is not a Moleculer transporter");
 	return { tx };
 }
@@ -23737,23 +23703,8 @@ function createHubService(deps) {
 				deps.onSetLogLevel?.(ctx.params.level);
 				return true;
 			} },
-			joinChallenge: { handler(ctx) {
-				if (deps.meshAuth === void 0) throw new Errors.MoleculerClientError("mesh join is not enabled on this node", 404);
-				return deps.meshAuth.issueChallenge(senderOf$1(ctx));
-			} },
-			authenticateNode: { handler(ctx) {
-				if (deps.meshAuth === void 0) throw new Errors.MoleculerClientError("mesh join is not enabled on this node", 404);
-				return deps.meshAuth.authenticate(senderOf$1(ctx), ctx.params);
-			} },
 			registerNode: { handler(ctx) {
-				if (deps.meshAuth !== void 0) {
-					deps.meshAuth.admitRegistration(senderOf$1(ctx), ctx.params);
-					deps.onRegisterNode?.(ctx.params);
-					return { ok: true };
-				}
-				const verdict = checkClusterSecret(deps.clusterSecretGate?.() ?? { kind: "off" }, ctx.params.clusterSecretHash);
-				if (verdict === "mismatch") throw new Errors.MoleculerError(`cluster secret mismatch — node "${ctx.params.nodeId}" rejected`, 403, CLUSTER_SECRET_MISMATCH_TYPE);
-				if (verdict === "unavailable") throw new Errors.MoleculerRetryableError(`the hub cannot read its cluster secret yet — node "${ctx.params.nodeId}" must retry`, 503, CLUSTER_SECRET_UNAVAILABLE_TYPE);
+				deps.meshIdentity?.admitRegistration(senderOf$1(ctx), ctx.params.nodeId);
 				deps.onRegisterNode?.(ctx.params);
 				return { ok: true };
 			} },
@@ -23900,14 +23851,14 @@ var HubNodeRegistry = class {
 //#region src/kernel/moleculer/register-node-client.ts
 /**
 * Build a `RegisterNodeParams` from a node id, its per-addon manifests,
-* optionally its device-scoped native caps, optionally the SHA-256 hash
-* of the cluster secret, and optionally the node's root-package identity
-* (runtime-updatable node packages: version visibility). `nativeCaps` is
-* omitted entirely on the first handshake; `clusterSecretHash` is omitted
-* when no secret is configured; `rootPackage` is omitted by nodes that do
-* not run the root-package model (UDS children).
-*/
-function buildNodeManifest(nodeId, addons, nativeCaps, clusterSecretHash, rootPackage) {
+* optionally its device-scoped native caps, and optionally the node's
+* root-package identity (runtime-updatable node packages: version
+* visibility). `nativeCaps` is omitted entirely on the first handshake;
+* `rootPackage` is omitted by nodes that do not run the root-package model
+* (UDS children). Who the sender is comes from its certificate (D857), not
+* from the payload.
+*/
+function buildNodeManifest(nodeId, addons, nativeCaps, rootPackage) {
 	return {
 		nodeId,
 		addons: addons.map((a) => ({
@@ -23919,7 +23870,6 @@ function buildNodeManifest(nodeId, addons, nativeCaps, clusterSecretHash, rootPa
 			addonId: n.addonId,
 			deviceIds: [...n.deviceIds]
 		})) },
-		...clusterSecretHash === void 0 ? {} : { clusterSecretHash },
 		...rootPackage === void 0 ? {} : { rootPackage: {
 			name: rootPackage.name,
 			version: rootPackage.version
@@ -23957,10 +23907,7 @@ async function callRegisterNodeWithRetry(broker, params, opts) {
 			if (attempt > 0) opts.log?.(`[register-node] ${action} acked after ${attempt + 1} attempt(s)`);
 			return;
 		} catch (err) {
-			if (isClusterSecretMismatchError(err)) {
-				opts.log?.(`[register-node] ${action} REJECTED — cluster secret mismatch; not retrying`);
-				throw err;
-			}
+			opts.onAttemptFailed?.(err);
 			attempt++;
 			const wait = Math.min(base * 2 ** (attempt - 1), 5e3);
 			opts.log?.(`[register-node] ${action} failed (attempt ${attempt}) — retrying in ${wait}ms: ${err instanceof Error ? err.message : String(err)}`);
@@ -23969,180 +23916,64 @@ async function callRegisterNodeWithRetry(broker, params, opts) {
 	}
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-join-proof.ts
-/**
-* Mesh join — the challenge–response that authenticates a node to the hub
-* (D802). Shared by the hub (`$hub.joinChallenge` / `$hub.authenticateNode`)
-* and the agent (`MeshJoinClient`).
-*
-* The exchange, over the clear-text Moleculer transport:
-*
-*   agent → hub   `$hub.joinChallenge {}`                        → { nonce }
-*   agent → hub   `$hub.authenticateNode { nodeId, nonce,
-*                                          clientNonce, proof }`  → { hubProof }
-*
-*   proof    = HMAC-SHA256(K, "camstack-mesh-join/v1|node|<nodeId>|<nonce>")
-*   hubProof = HMAC-SHA256(K, "camstack-mesh-join/v1|hub|<nodeId>|<nonce>|<clientNonce>")
-*   K        = SHA-256(cluster secret)   — the value each side already holds
-*
-* What it buys over the D797 hash (`clusterSecretHash` in `registerNode`):
-*  - nothing reusable crosses the wire: the nonce is the hub's, single use,
-*    short-lived and bound to the SENDER node id, so a sniffed proof answers a
-*    challenge that no longer exists;
-*  - the agent authenticates the HUB too (`hubProof` over the agent's own
-*    nonce): a rogue node answering to `hub` on the LAN — found through UDP
-*    discovery — cannot prove it knows the secret, and the agent refuses it.
-*
-* What it does NOT buy: the transport stays clear text, and the sender node id
-* of every later packet is self-declared. A LAN host that watches a node join
-* can still spoof that node id afterwards. Only mutual TLS (the next step,
-* `docs/design/2026-10-09-mesh-mtls-plan.md`) closes that.
-*/
-/** Protocol version carried by the challenge; the agent refuses one it does not speak. */
-var MESH_JOIN_PROTOCOL = 1;
-var DOMAIN = "camstack-mesh-join/v1";
-/** The hub's action that hands out a single-use nonce. */
-var MESH_JOIN_CHALLENGE_ACTION = "$hub.joinChallenge";
-/** The hub's action that verifies a node's proof and answers with its own. */
-var MESH_JOIN_AUTHENTICATE_ACTION = "$hub.authenticateNode";
-/** Moleculer error `type`: the sender has not authenticated and the hub enforces it. */
+//#region src/kernel/moleculer/mesh-identity.ts
+/**
+* Mesh identity (D857) — who is calling a node, decided by the CERTIFICATE.
+*
+* There is no shared secret. A node is admitted by the mesh when its mutual-TLS
+* handshake chained to the mesh CA, its leaf CN is the node id it speaks as, and
+* the leaf is not revoked (D856). The transport enforces the first two on every
+* packet (`TlsTcpTransporter.onIncomingMessage` drops a `sender` that is not the
+* peer CN), and answers the third through `verifiedPeer`. These gates do one
+* thing: turn "is this sender a verified peer" into allow or deny, and keep a
+* short list of actions no other node may ever call.
+*
+* Hub gate:   every other node must be a verified peer.
+* Agent gate: only the verified hub may call an agent; an agent's mesh has no
+*             other peer (D848).
+*
+* Nothing here reads a credential, mints a nonce or remembers a node's state:
+* a verdict is a pure function of the transport's current knowledge, so a
+* revocation takes effect on the next packet.
+*/
+/** Moleculer error `type`: the sender has no certificate identity this node accepts. */
 var MESH_NODE_UNAUTHENTICATED_TYPE = "MESH_NODE_UNAUTHENTICATED";
 /** Moleculer error `type`: the action is never callable from another node. */
 var MESH_ACTION_FORBIDDEN_TYPE = "MESH_ACTION_FORBIDDEN";
-/** Moleculer error `type`: the challenge is unknown, used or expired — ask for a new one. */
-var MESH_JOIN_CHALLENGE_INVALID_TYPE = "MESH_JOIN_CHALLENGE_INVALID";
-/** A fresh 32-byte nonce, hex. */
-function createMeshNonce() {
-	return randomBytes(32).toString("hex");
-}
-function hmacHex(secretHash, message) {
-	return createHmac("sha256", Buffer.from(secretHash, "utf8")).update(message, "utf8").digest("hex");
-}
-/** The node's answer to the hub's nonce. `secretHash` is `hashClusterSecret(secret)`. */
-function computeNodeJoinProof(secretHash, nodeId, nonce) {
-	return hmacHex(secretHash, `${DOMAIN}|node|${nodeId}|${nonce}`);
-}
-/** The hub's answer to the node's nonce — proves the hub holds the same secret. */
-function computeHubJoinProof(secretHash, nodeId, nonce, clientNonce) {
-	return hmacHex(secretHash, `${DOMAIN}|hub|${nodeId}|${nonce}|${clientNonce}`);
-}
-/** Constant-time comparison of two hex proofs; any shape mismatch is `false`. */
-function proofsEqual(expected, presented) {
-	if (typeof presented !== "string" || presented.length !== expected.length) return false;
-	return timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(presented, "utf8"));
-}
 /** Reads a Moleculer error's `type`, including after an RPC round-trip. */
 function meshErrorType(err) {
 	if (typeof err !== "object" || err === null || !("type" in err)) return null;
 	const { type } = err;
 	return typeof type === "string" ? type : null;
 }
-//#endregion
-//#region src/kernel/moleculer/mesh-authenticator.ts
-/**
-* MeshAuthenticator — the hub's record of WHICH node is calling, and whether
-* it proved it (D802).
-*
-* Every remote Moleculer action and event reaching the hub passes through
-* {@link MeshAuthenticator.admitCall} (wired as a broker middleware,
-* `mesh-access-middleware.ts`). The sender node id Moleculer reports is
-* self-declared; this class binds it to a proof:
-*
-*  - `$hub.joinChallenge` → a single-use nonce bound to the sender;
-*  - `$hub.authenticateNode` → the node's HMAC over that nonce and its own id
-*    (`mesh-join-proof.ts`). Success marks the node `authenticated` until its
-*    connection drops (`forget`, on `$node.disconnected`).
-*
-* Policy, per remote action:
-*  - the join actions and `registerNode` are open (they ARE the
-*    authentication; `registerNode` applies its own rule below);
-*  - {@link isRemoteForbiddenAction}: never from another node, whoever it is;
-*  - otherwise an authenticated (or, in `transition`, legacy) node is allowed;
-*    an unauthenticated one is refused in `enforced` and tolerated — with a
-*    warning and a row on System → Cluster — in `transition`.
-*
-* `registerNode` (`admitRegistration`): a node registers only itself; an
-* authenticated node always may; the D797 hash is accepted as `legacy` in
-* `transition` only; no proof at all is tolerated in `transition` only.
-*/
-/** A challenge is answered within this window or not at all. */
-var MESH_JOIN_CHALLENGE_TTL_MS = 6e4;
-/** Outstanding challenges kept at most — a flood of fake node ids evicts the oldest. */
-var MAX_PENDING_CHALLENGES = 256;
-/** Unauthenticated senders remembered for the status page — bounded the same way. */
-var MAX_TRACKED_NODES$1 = 256;
-/** Actions any node may call before it has authenticated. */
-var PRE_AUTH_ACTIONS = new Set([
-	MESH_JOIN_CHALLENGE_ACTION,
-	MESH_JOIN_AUTHENTICATE_ACTION,
-	"$hub.registerNode"
-]);
 /**
 * Services and actions no other node ever calls on the hub. `$process` spawns
 * runners with an arbitrary environment (code execution); `$node` is
 * Moleculer's introspection; `setLogLevel` is an operator action the hub
-* issues itself. Nothing in the cluster calls them remotely, so refusing them
-* costs nothing and closes the cheapest routes to the hub.
+* issues itself.
 */
-var REMOTE_FORBIDDEN_SERVICES$1 = new Set(["$process", "$node"]);
-var REMOTE_FORBIDDEN_ACTIONS = new Set(["$hub.setLogLevel"]);
+var HUB_FORBIDDEN_SERVICES = new Set(["$process", "$node"]);
+var HUB_FORBIDDEN_ACTIONS = new Set(["$hub.setLogLevel"]);
 function isRemoteForbiddenAction(action) {
-	if (REMOTE_FORBIDDEN_ACTIONS.has(action)) return true;
+	if (HUB_FORBIDDEN_ACTIONS.has(action)) return true;
+	const dot = action.indexOf(".");
+	return dot > 0 && HUB_FORBIDDEN_SERVICES.has(action.slice(0, dot));
+}
+/** Moleculer introspection — never from another node, on an agent either. */
+var AGENT_FORBIDDEN_SERVICES = new Set(["$node"]);
+function isRemoteForbiddenOnAgent(action) {
 	const dot = action.indexOf(".");
-	return dot > 0 && REMOTE_FORBIDDEN_SERVICES$1.has(action.slice(0, dot));
+	return dot > 0 && AGENT_FORBIDDEN_SERVICES.has(action.slice(0, dot));
 }
 function refuse(message, type, code = 403) {
 	return new Errors.MoleculerClientError(message, code, type);
 }
-var MeshAuthenticator = class {
+var NOT_PAIRED_HINT = "pair it with this hub (System → Cluster → Agents) so it holds a certificate from the mesh CA";
+/** The hub's gate: every other node must hold a verified certificate identity. */
+var MeshIdentityGate = class {
 	deps;
-	challenges = /* @__PURE__ */ new Map();
-	nodes = /* @__PURE__ */ new Map();
-	/** Completed the challenge–response at least once since the hub started. */
-	everAuthenticated = /* @__PURE__ */ new Set();
-	/** Let in WITHOUT the challenge–response at least once since the hub started. */
-	everTolerated = /* @__PURE__ */ new Set();
-	now;
 	constructor(deps) {
 		this.deps = deps;
-		this.now = deps.now ?? Date.now;
-	}
-	issueChallenge(sender) {
-		const nonce = createMeshNonce();
-		this.challenges.delete(sender);
-		if (this.challenges.size >= MAX_PENDING_CHALLENGES) {
-			const oldest = this.challenges.keys().next().value;
-			if (oldest !== void 0) this.challenges.delete(oldest);
-		}
-		this.challenges.set(sender, {
-			nonce,
-			expiresAt: this.now() + MESH_JOIN_CHALLENGE_TTL_MS
-		});
-		return {
-			protocol: 1,
-			nonce
-		};
-	}
-	authenticate(sender, params) {
-		if (params.nodeId !== sender) throw refuse(`mesh join refused: node "${sender}" presented a proof for "${String(params.nodeId)}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
-		const pending = this.challenges.get(sender);
-		this.challenges.delete(sender);
-		if (pending === void 0 || pending.expiresAt < this.now() || typeof params.nonce !== "string" || !proofsEqual(pending.nonce, params.nonce)) throw refuse(`mesh join refused: no live challenge for node "${sender}" — ask for a new one`, MESH_JOIN_CHALLENGE_INVALID_TYPE);
-		const hash = this.secretHashOrThrow(sender);
-		if (!proofsEqual(computeNodeJoinProof(hash, sender, pending.nonce), params.proof)) throw refuse(`cluster secret mismatch — node "${sender}" rejected`, CLUSTER_SECRET_MISMATCH_TYPE);
-		this.record(sender, "authenticated");
-		this.everAuthenticated.add(sender);
-		this.deps.onAuthenticated?.(sender);
-		const clientNonce = typeof params.clientNonce === "string" ? params.clientNonce : "";
-		return {
-			ok: true,
-			hubProof: computeHubJoinProof(hash, sender, pending.nonce, clientNonce)
-		};
-	}
-	/** The node's connection dropped: it authenticates again when it returns. */
-	forget(nodeId) {
-		this.nodes.delete(nodeId);
-		this.challenges.delete(nodeId);
 	}
 	admitCall(sender, action) {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
@@ -24151,7 +23982,6 @@ var MeshAuthenticator = class {
 			errorType: MESH_ACTION_FORBIDDEN_TYPE,
 			message: `"${action}" is not callable from another node (caller "${sender}")`
 		};
-		if (PRE_AUTH_ACTIONS.has(action)) return { verdict: "allow" };
 		return this.admitSender(sender, action);
 	}
 	/** Same rule as a call, for an inbound event. */
@@ -24159,103 +23989,72 @@ var MeshAuthenticator = class {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
 		return this.admitSender(sender, `event:${eventName}`);
 	}
+	/** Throws when `sender` may not register `nodeId`: a node registers only itself. */
+	admitRegistration(sender, nodeId) {
+		if (sender === this.deps.ownNodeId) return;
+		if (nodeId !== sender) throw refuse(`registration refused: node "${sender}" may register only itself, not "${nodeId}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
+		if (!this.deps.isVerifiedPeer(sender)) {
+			this.deps.onRefused?.(sender, "$hub.registerNode");
+			throw refuse(`node "${sender}" holds no valid mesh certificate — ${NOT_PAIRED_HINT}`, MESH_NODE_UNAUTHENTICATED_TYPE);
+		}
+	}
 	admitSender(sender, what) {
-		const state = this.stateOf(sender);
-		if (state === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
-		if (this.deps.mode() === "enforced") return {
+		if (this.deps.isVerifiedPeer(sender)) return { verdict: "allow" };
+		this.deps.onRefused?.(sender, what);
+		return {
 			verdict: "deny",
 			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `node "${sender}" has not authenticated to this hub — enter the hub cluster secret (System → Cluster) in the agent and restart it`
+			message: `node "${sender}" holds no valid mesh certificate — ${NOT_PAIRED_HINT}`
 		};
-		if (state === "legacy") return { verdict: "allow" };
-		if (!this.nodes.has(sender)) {
-			this.record(sender, "unauthenticated");
-			this.noteTolerated(sender);
-			this.deps.onTolerated?.(sender, what);
-		}
-		return { verdict: "tolerate" };
-	}
-	/** Throws when `sender` may not register `params`; returns when it may. */
-	admitRegistration(sender, params) {
-		if (sender === this.deps.ownNodeId) return;
-		if (params.nodeId !== sender) throw refuse(`registration refused: node "${sender}" may register only itself, not "${params.nodeId}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
-		if (this.stateOf(sender) === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return;
-		if (this.deps.mode() === "enforced") throw refuse(`cluster secret mismatch — node "${sender}" rejected: this hub requires agents to authenticate with the cluster secret (System → Cluster); update the agent and enter it`, CLUSTER_SECRET_MISMATCH_TYPE);
-		if (params.clusterSecretHash === void 0) {
-			this.admitSender(sender, "$hub.registerNode");
-			return;
-		}
-		const verdict = checkClusterSecret(this.deps.gate(), params.clusterSecretHash);
-		if (verdict === "mismatch") throw refuse(`cluster secret mismatch — node "${sender}" rejected`, CLUSTER_SECRET_MISMATCH_TYPE);
-		if (verdict === "unavailable") throw new Errors.MoleculerRetryableError(`the hub cannot read its cluster secret yet — node "${sender}" must retry`, 503, CLUSTER_SECRET_UNAVAILABLE_TYPE);
-		this.record(sender, this.deps.gate().kind === "on" ? "legacy" : "unauthenticated");
-		this.noteTolerated(sender);
-	}
-	noteTolerated(nodeId) {
-		if (this.everTolerated.size >= MAX_TRACKED_NODES$1) return;
-		this.everTolerated.add(nodeId);
 	}
-	stateOf(nodeId) {
-		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
-	}
-	/** Node ids that completed the challenge–response on their current connection. */
-	authenticatedNodeIds() {
-		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
+};
+/**
+* An agent's inbound gate: the hub, proven by the certificate the agent's TLS
+* listener already verified, and nobody else. An agent that is not paired holds
+* no certificate, so it admits no one.
+*/
+var AgentMeshIdentityGate = class {
+	deps;
+	hubNodeId;
+	constructor(deps) {
+		this.deps = deps;
+		this.hubNodeId = deps.hubNodeId ?? "hub";
 	}
-	/** Node ids that ever completed the challenge–response since the hub started. */
-	everAuthenticatedNodeIds() {
-		return this.everAuthenticated;
+	admitCall(sender, action) {
+		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
+		if (isRemoteForbiddenOnAgent(action)) return {
+			verdict: "deny",
+			errorType: MESH_ACTION_FORBIDDEN_TYPE,
+			message: `"${action}" is not callable from another node (caller "${sender}")`
+		};
+		return this.admitSender(sender, action);
 	}
-	/**
-	* Node ids let in without the challenge–response since the hub started.
-	* Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
-	* and the ones already here keep the transition open (the operator can still
-	* switch to `enforced` by hand).
-	*/
-	everToleratedNodeIds() {
-		return [...this.everTolerated];
+	admitEvent(sender, eventName) {
+		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
+		return this.admitSender(sender, `event:${eventName}`);
 	}
-	snapshot() {
-		const nodes = [...this.nodes].map(([nodeId, r]) => ({
-			nodeId,
-			state: r.state,
-			since: r.since
-		})).toSorted((a, b) => a.nodeId.localeCompare(b.nodeId));
+	admitSender(sender, what) {
+		if (sender === this.hubNodeId && this.deps.isVerifiedPeer(sender)) return { verdict: "allow" };
+		this.deps.onRefused?.(sender, what);
 		return {
-			mode: this.deps.mode(),
-			nodes
+			verdict: "deny",
+			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+			message: `node "${sender}" is not accepted by this agent — only the hub, proven by the certificate this agent's TLS listener verified, may call it`
 		};
 	}
-	record(nodeId, state) {
-		this.nodes.delete(nodeId);
-		if (this.nodes.size >= MAX_TRACKED_NODES$1) {
-			const oldestTolerated = [...this.nodes].find(([, r]) => r.state === "unauthenticated");
-			if (oldestTolerated !== void 0) this.nodes.delete(oldestTolerated[0]);
-		}
-		this.nodes.set(nodeId, {
-			state,
-			since: this.now()
-		});
-	}
-	secretHashOrThrow(sender) {
-		const gate = this.deps.gate();
-		if (gate.kind === "on") return gate.hash;
-		throw new Errors.MoleculerRetryableError(gate.kind === "off" ? `the hub has no cluster secret yet — node "${sender}" must retry` : `the hub cannot read its cluster secret yet — node "${sender}" must retry`, 503, CLUSTER_SECRET_UNAVAILABLE_TYPE);
-	}
 };
 //#endregion
 //#region src/kernel/moleculer/mesh-access-middleware.ts
 /**
-* Mesh gate middleware (D802): wraps every LOCAL action and event handler so
-* it sees each request another node sends with `ctx.nodeID` = the sender.
+* Mesh gate middleware (D802, D857): wraps every LOCAL action and event handler
+* so it sees each request another node sends with `ctx.nodeID` = the sender.
 *
 * Used on both sides of the mesh:
-*  - hub: {@link MeshAuthenticator} (challenge–response join);
-*  - agent: {@link AgentMeshAuthenticator} (hub proven by mutual join + own
-*    children via `$agent.registerNode`).
+*  - hub: {@link MeshIdentityGate} (the sender holds a verified certificate);
+*  - agent: {@link AgentMeshIdentityGate} (the sender is the certified hub).
 *
 * For a request from another node it:
-*  1. asks the gate's `admitCall` — refuse, tolerate or allow;
+*  1. asks the gate's `admitCall` — refuse or allow;
 *  2. strips a forged identity from the params ({@link stripForgedIdentity}).
 *
 * Calls a node makes to itself (`ctx.nodeID` = own) pass untouched.
@@ -24298,6 +24097,9 @@ function senderOf(ctx) {
 	const nodeID = ctx.nodeID;
 	return typeof nodeID === "string" && nodeID.length > 0 ? nodeID : null;
 }
+function noSenderError(action) {
+	return new Errors.MoleculerClientError(`"${action}" refused: the call names no sender node`, 403, MESH_NODE_UNAUTHENTICATED_TYPE);
+}
 function paramNodeId(params) {
 	return params !== null && typeof params === "object" ? Reflect.get(params, "nodeId") : void 0;
 }
@@ -24306,7 +24108,7 @@ function paramNodeId(params) {
 * so it wraps every service, including the ones Moleculer creates itself.
 */
 function createMeshAccessMiddleware(options) {
-	const { ownNodeId, authenticator, logger } = options;
+	const { ownNodeId, gate, logger } = options;
 	const dropped = /* @__PURE__ */ new Map();
 	const noteDroppedEvent = (sender, eventName) => {
 		const now = Date.now();
@@ -24336,10 +24138,9 @@ function createMeshAccessMiddleware(options) {
 			const name = action.name ?? "";
 			return function meshGatedAction(ctx) {
 				const sender = senderOf(ctx);
-				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
-				const verdict = authenticator.admitCall(sender, name);
-				if (verdict.verdict === "hold") return verdict.settled.then((settled) => runAdmitted.call(this, ctx, sender, settled));
-				return runAdmitted.call(this, ctx, sender, verdict);
+				if (sender === null) return Promise.reject(noSenderError(name));
+				if (sender === ownNodeId) return next.call(this, ctx);
+				return runAdmitted.call(this, ctx, sender, gate.admitCall(sender, name));
 			};
 			function runAdmitted(ctx, sender, verdict) {
 				if (verdict.verdict === "deny") {
@@ -24359,235 +24160,21 @@ function createMeshAccessMiddleware(options) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
-				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
-				const verdict = authenticator.admitEvent(sender, name);
-				const deliver = (settled) => {
-					if (settled.verdict === "deny") {
-						noteDroppedEvent(sender, name);
-						return Promise.resolve();
-					}
-					return Promise.resolve(next.call(this, ctx));
-				};
-				return verdict.verdict === "hold" ? verdict.settled.then(deliver) : deliver(verdict);
+				if (sender === null) {
+					noteDroppedEvent("(no sender)", name);
+					return Promise.resolve();
+				}
+				if (sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
+				if (gate.admitEvent(sender, name).verdict === "deny") {
+					noteDroppedEvent(sender, name);
+					return Promise.resolve();
+				}
+				return Promise.resolve(next.call(this, ctx));
 			};
 		}
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-join-hold.ts
-var DEFAULT_MESH_JOIN_MAX_HELD = 1e3;
-var DEFAULT_MESH_JOIN_MAX_HOLD_MS = 15e3;
-var MeshJoinHold = class {
-	opts;
-	waiters = [];
-	firstHeldAt = null;
-	overflow = 0;
-	timer = null;
-	/** Holding is open while a join is in flight; closed after a decision or the bound. */
-	open = true;
-	now;
-	constructor(opts) {
-		this.opts = opts;
-		this.now = opts.now ?? Date.now;
-	}
-	/** Whether a request arriving now would be held (a join is in flight). */
-	get holding() {
-		return this.open;
-	}
-	/** How many requests wait right now. */
-	get size() {
-		return this.waiters.length;
-	}
-	/** A join started: hold again. */
-	reopen() {
-		this.open = true;
-	}
-	/** Hold one request; `null` when holding is closed (the caller refuses it). */
-	hold(kind) {
-		if (!this.open) return null;
-		if (this.waiters.length >= (this.opts.maxHeld ?? 1e3)) {
-			this.overflow++;
-			return {
-				verdict: "hold",
-				settled: Promise.resolve(this.refusal("the hold before the mesh join is full"))
-			};
-		}
-		if (this.firstHeldAt === null) {
-			this.firstHeldAt = this.now();
-			this.timer = setTimeout(() => this.refuse("bound"), this.opts.maxHoldMs ?? 15e3);
-			this.timer.unref?.();
-		}
-		return {
-			verdict: "hold",
-			settled: new Promise((resolve) => {
-				this.waiters.push({
-					kind,
-					resolve
-				});
-			})
-		};
-	}
-	/** The join proved the hub: deliver everything held, in order. */
-	release() {
-		this.open = false;
-		this.settle({ verdict: "allow" }, "delivered", "authenticated");
-	}
-	/** The join failed, or the bound ran out: refuse everything held. */
-	refuse(reason) {
-		this.open = false;
-		this.settle(this.refusal(`the join ended "${reason}"`), "refused", reason);
-	}
-	refusal(why) {
-		return {
-			verdict: "deny",
-			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `"${this.opts.hubNodeId}" sent this before the mesh join settled, and ${why}`
-		};
-	}
-	settle(verdict, outcome, reason) {
-		if (this.timer !== null) clearTimeout(this.timer);
-		this.timer = null;
-		const waiters = this.waiters;
-		const overflow = this.overflow;
-		const firstHeldAt = this.firstHeldAt;
-		this.waiters = [];
-		this.overflow = 0;
-		this.firstHeldAt = null;
-		if (waiters.length === 0 && overflow === 0) return;
-		for (const w of waiters) w.resolve(verdict);
-		this.opts.onReport?.({
-			outcome,
-			reason,
-			events: waiters.filter((w) => w.kind === "event").length,
-			calls: waiters.filter((w) => w.kind === "call").length,
-			overflow,
-			heldForMs: firstHeldAt === null ? 0 : this.now() - firstHeldAt
-		});
-	}
-};
-//#endregion
-//#region src/kernel/moleculer/agent-mesh-authenticator.ts
-/** The child's register action on its parent agent. */
-var AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
-var DEFAULT_HUB_NODE_ID = "hub";
-var MAX_TRACKED_NODES = 256;
-/** Moleculer introspection — never from another node, on an agent either. */
-var REMOTE_FORBIDDEN_SERVICES = new Set(["$node"]);
-function isRemoteForbiddenOnAgent(action) {
-	const dot = action.indexOf(".");
-	return dot > 0 && REMOTE_FORBIDDEN_SERVICES.has(action.slice(0, dot));
-}
-function isOwnChildNodeId(ownNodeId, sender) {
-	return sender.startsWith(`${ownNodeId}/`);
-}
-var AgentMeshAuthenticator = class {
-	deps;
-	nodes = /* @__PURE__ */ new Map();
-	hubNodeId;
-	now;
-	hold;
-	constructor(deps) {
-		this.deps = deps;
-		this.hubNodeId = deps.hubNodeId ?? DEFAULT_HUB_NODE_ID;
-		this.now = deps.now ?? Date.now;
-		this.hold = new MeshJoinHold({
-			hubNodeId: this.hubNodeId,
-			now: this.now,
-			...deps.maxHeld !== void 0 ? { maxHeld: deps.maxHeld } : {},
-			...deps.maxHoldMs !== void 0 ? { maxHoldMs: deps.maxHoldMs } : {},
-			...deps.onHoldReport !== void 0 ? { onReport: deps.onHoldReport } : {}
-		});
-	}
-	/** How many of the hub's requests wait for the join right now. */
-	heldCount() {
-		return this.hold.size;
-	}
-	/** Current mode: a secret OR a certificate → enforce; else tolerate (upgrade path). */
-	mode() {
-		return this.deps.hasSecret() || this.deps.isPaired?.() === true ? "enforced" : "transition";
-	}
-	/**
-	* Reflect a settled mesh join. `authenticated` stamps the hub; a blocking
-	* failure forgets it so an impostor cannot call in; transitional states
-	* leave the hub unmarked (calls are tolerated while mode is `transition`).
-	*/
-	noteHubJoinState(state) {
-		if (state === "authenticated") {
-			this.record(this.hubNodeId, "authenticated");
-			this.hold.release();
-			return;
-		}
-		if (state === "pending") {
-			this.forget(this.hubNodeId);
-			this.hold.reopen();
-			return;
-		}
-		if (state === "secret-mismatch" || state === "hub-unverified") this.forget(this.hubNodeId);
-		this.hold.refuse(state);
-	}
-	/** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
-	noteChildRegistered(sender, proof = "authenticated") {
-		if (!isOwnChildNodeId(this.deps.ownNodeId, sender)) return;
-		this.record(sender, proof);
-	}
-	/** The peer's connection dropped. */
-	forget(nodeId) {
-		this.nodes.delete(nodeId);
-	}
-	admitCall(sender, action) {
-		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		if (isRemoteForbiddenOnAgent(action)) return {
-			verdict: "deny",
-			errorType: MESH_ACTION_FORBIDDEN_TYPE,
-			message: `"${action}" is not callable from another node (caller "${sender}")`
-		};
-		if (action === "$agent.registerNode" && isOwnChildNodeId(this.deps.ownNodeId, sender)) return { verdict: "allow" };
-		return this.admitSender(sender, action, "call");
-	}
-	admitEvent(sender, eventName) {
-		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		return this.admitSender(sender, `event:${eventName}`, "event");
-	}
-	stateOf(nodeId) {
-		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
-	}
-	authenticatedNodeIds() {
-		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
-	}
-	admitSender(sender, what, kind) {
-		const state = this.stateOf(sender);
-		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
-		if (sender === this.hubNodeId && this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
-		if (this.mode() === "enforced") {
-			if (sender === this.hubNodeId) {
-				const held = this.hold.hold(kind);
-				if (held !== null) return held;
-			}
-			return {
-				verdict: "deny",
-				errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-				message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
-			};
-		}
-		if (!this.nodes.has(sender)) {
-			this.record(sender, "unauthenticated");
-			this.deps.onTolerated?.(sender, what);
-		}
-		return { verdict: "tolerate" };
-	}
-	record(nodeId, state) {
-		this.nodes.delete(nodeId);
-		if (this.nodes.size >= MAX_TRACKED_NODES) {
-			const oldest = this.nodes.keys().next().value;
-			if (oldest !== void 0) this.nodes.delete(oldest);
-		}
-		this.nodes.set(nodeId, {
-			state,
-			since: this.now()
-		});
-	}
-};
-//#endregion
 //#region src/kernel/moleculer/agent-event-scope.ts
 /** Moleculer's EVENT packet type (`packets.PACKET_EVENT`). */
 var PACKET_EVENT = "EVENT";
@@ -24622,213 +24209,6 @@ function createAgentEventScope(opts) {
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-join-client.ts
-/** States in which a call to the hub is refused locally. */
-var BLOCKING = new Set(["secret-mismatch", "hub-unverified"]);
-/** Error `type`s meaning "the hub has no such action": it predates D802. */
-var UNSUPPORTED = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-function errText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-function errCode(err) {
-	if (typeof err !== "object" || err === null || !("code" in err)) return null;
-	const { code } = err;
-	return typeof code === "number" ? code : null;
-}
-function readString(value, key) {
-	if (value === null || typeof value !== "object") return null;
-	const v = Reflect.get(value, key);
-	return typeof v === "string" ? v : null;
-}
-var MeshJoinClient = class {
-	opts;
-	current = "pending";
-	settledWaiters = [];
-	inFlight = null;
-	hubNodeId;
-	constructor(opts) {
-		this.opts = opts;
-		this.hubNodeId = opts.hubNodeId ?? "hub";
-	}
-	get state() {
-		return this.current;
-	}
-	/** Did this agent prove itself on the current connection? */
-	get authenticated() {
-		return this.current === "authenticated";
-	}
-	/**
-	* Run the join. Concurrent callers share one attempt. Resolves with the
-	* settled state; never rejects.
-	*/
-	join() {
-		if (this.inFlight !== null) return this.inFlight;
-		const attempt = this.runJoin().then((state) => {
-			this.inFlight = null;
-			this.settle(state);
-			return state;
-		});
-		this.inFlight = attempt;
-		return attempt;
-	}
-	/** The hub connection dropped: the next connection authenticates again. */
-	reset() {
-		this.current = "pending";
-	}
-	/** Resolves when a call to the hub may go out; rejects when it must not. */
-	async whenCallable() {
-		if (this.current === "pending") {
-			let timer;
-			const settled = await Promise.race([new Promise((resolve) => this.settledWaiters.push(() => resolve(true))), new Promise((resolve) => {
-				timer = setTimeout(() => resolve(false), this.opts.pendingWaitMs ?? 3e4);
-				timer.unref?.();
-			})]);
-			if (timer !== void 0) clearTimeout(timer);
-			if (!settled) throw new Error(`the mesh join with "${this.hubNodeId}" has not completed — the call was not sent`);
-		}
-		if (!BLOCKING.has(this.current)) return;
-		if (this.current === "secret-mismatch") throw new Error("the hub refused this agent: cluster secret mismatch — copy the cluster secret from the hub's System → Cluster page into this agent's setup");
-		throw new Error(`the node answering as "${this.hubNodeId}" could not prove it holds the cluster secret — refusing to talk to it (check the hub address and the secret)`);
-	}
-	/**
-	* Moleculer middleware for the AGENT broker: every call to the hub node waits
-	* for the join; a hub answer "not authenticated" (the hub restarted and lost
-	* us) triggers a new join.
-	*/
-	middleware(onUnauthenticated) {
-		const hubNodeId = this.hubNodeId;
-		const whenCallable = () => this.whenCallable();
-		const secretPresent = () => this.secretPresent();
-		return {
-			name: "CamstackMeshJoin",
-			remoteAction(next, action) {
-				const name = action.name ?? "";
-				if (name === "$hub.joinChallenge" || name === "$hub.authenticateNode") return next;
-				return async function meshJoinGated(ctx) {
-					if (ctx.nodeID !== hubNodeId) return next.call(this, ctx);
-					await whenCallable();
-					try {
-						return await next.call(this, ctx);
-					} catch (err) {
-						if (meshErrorType(err) === "MESH_NODE_UNAUTHENTICATED" && secretPresent()) onUnauthenticated?.();
-						throw err;
-					}
-				};
-			}
-		};
-	}
-	secretPresent() {
-		const s = this.opts.secret();
-		return s !== null && s.length > 0;
-	}
-	settle(state) {
-		this.current = state;
-		this.opts.onSettled?.(state);
-		const waiters = this.settledWaiters;
-		this.settledWaiters = [];
-		for (const w of waiters) w();
-	}
-	async runJoin() {
-		const secret = this.opts.secret();
-		if (secret === null || secret.length === 0) return "no-secret";
-		const hash = hashClusterSecret(secret);
-		const maxAttempts = this.opts.maxAttempts ?? 5;
-		let last = "unavailable";
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-			const outcome = await this.attempt(hash);
-			if (outcome !== "retry") return outcome;
-			last = "unavailable";
-			await new Promise((r) => setTimeout(r, (this.opts.retryDelayMs ?? 1e3) * attempt));
-		}
-		return last;
-	}
-	async attempt(hash) {
-		const callOpts = {
-			nodeID: this.hubNodeId,
-			timeout: this.opts.callTimeoutMs ?? 1e4
-		};
-		const nodeId = this.opts.nodeId;
-		try {
-			const challenge = await this.opts.call(MESH_JOIN_CHALLENGE_ACTION, {}, callOpts);
-			const nonce = readString(challenge, "nonce");
-			const protocol = challenge !== null && typeof challenge === "object" ? Reflect.get(challenge, "protocol") : void 0;
-			if (nonce === null || protocol !== 1) {
-				this.opts.log?.(`[mesh-join] the hub sent a challenge this agent does not speak`);
-				return "unsupported";
-			}
-			const clientNonce = createMeshNonce();
-			const answer = await this.opts.call(MESH_JOIN_AUTHENTICATE_ACTION, {
-				nodeId,
-				nonce,
-				clientNonce,
-				proof: computeNodeJoinProof(hash, nodeId, nonce)
-			}, callOpts);
-			if (!proofsEqual(computeHubJoinProof(hash, nodeId, nonce, clientNonce), readString(answer, "hubProof"))) {
-				this.opts.log?.(`[mesh-join] the hub could not prove it holds the cluster secret — refused`);
-				return "hub-unverified";
-			}
-			this.opts.log?.(`[mesh-join] authenticated to the hub (mutual)`);
-			return "authenticated";
-		} catch (err) {
-			const type = meshErrorType(err);
-			if (type === "CLUSTER_SECRET_MISMATCH") {
-				this.opts.log?.(`[mesh-join] the hub refused our proof: cluster secret mismatch`);
-				return "secret-mismatch";
-			}
-			if (type !== null && UNSUPPORTED.has(type) || errCode(err) === 404) {
-				this.opts.log?.(`[mesh-join] the hub predates the mesh join — legacy registration`);
-				return "unsupported";
-			}
-			this.opts.log?.(`[mesh-join] join attempt failed (${type ?? "error"}): ${errText(err)}`);
-			return "retry";
-		}
-	}
-};
-//#endregion
-//#region src/kernel/moleculer/mesh-auto-enforce.ts
-/** Boot grace before an empty or partial roster can end the transition. */
-var MESH_AUTO_ENFORCE_GRACE_MS = 5 * 6e4;
-function isAgentId(id, ownNodeId) {
-	return id !== ownNodeId && !id.includes("/");
-}
-function decideMeshAutoEnforce(input) {
-	if (input.mode !== "transition") return {
-		enforce: false,
-		waitingFor: [],
-		why: "not in transition"
-	};
-	if (input.gate !== "on") return {
-		enforce: false,
-		waitingFor: [],
-		why: "no readable cluster secret"
-	};
-	if (input.knownAgents === null) return {
-		enforce: false,
-		waitingFor: [],
-		why: "the cluster-node history has not answered"
-	};
-	if (input.uptimeMs < (input.graceMs ?? 3e5)) return {
-		enforce: false,
-		waitingFor: [],
-		why: "boot grace period"
-	};
-	const known = new Set([
-		...input.knownAgents,
-		...input.connected,
-		...input.toleratedEver
-	].filter((id) => isAgentId(id, input.ownNodeId)));
-	const waitingFor = [...known].filter((id) => !input.authenticatedEver.has(id)).toSorted();
-	if (waitingFor.length > 0) return {
-		enforce: false,
-		waitingFor,
-		why: "agents have not authenticated yet"
-	};
-	return {
-		enforce: true,
-		reason: known.size === 0 ? "no agent has ever joined this hub" : `every known agent has authenticated (${[...known].toSorted().join(", ")})`
-	};
-}
-//#endregion
 //#region src/kernel/moleculer/readiness-service.ts
 /**
 * Service name AGENTS register their own readiness snapshot under.
@@ -27111,4 +26491,4 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshAuthenticator, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshJoinClient, MeshJoinHold, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectAgentNames, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintAgentUiUnlockTicketEs256, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshCertificateRegistry, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyAgentUiUnlockTicketEs256, verifyDeviceLeaf, verifyDeviceSignature, verifyMeshJoinToken, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };