@skillkit/mesh 1.8.0

package/dist/index.d.ts

@@ -0,0 +1,781 @@
+import WebSocket from 'ws';
+
+interface PeerKeypair {
+    publicKey: Uint8Array;
+    privateKey: Uint8Array;
+    fingerprint: string;
+}
+interface SerializedIdentity {
+    publicKey: string;
+    privateKey: string;
+    fingerprint: string;
+}
+declare class PeerIdentity {
+    private keypair;
+    private constructor();
+    static generate(): Promise<PeerIdentity>;
+    static fromPrivateKey(privateKey: Uint8Array): Promise<PeerIdentity>;
+    static fromSerialized(data: SerializedIdentity): PeerIdentity;
+    static computeFingerprint(publicKey: Uint8Array): string;
+    static verify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): Promise<boolean>;
+    static verifyHex(signatureHex: string, messageHex: string, publicKeyHex: string): Promise<boolean>;
+    sign(message: Uint8Array): Promise<Uint8Array>;
+    signString(message: string): Promise<string>;
+    signObject(obj: object): Promise<string>;
+    deriveSharedSecret(peerPublicKey: Uint8Array): Uint8Array;
+    deriveSharedSecretHex(peerPublicKeyHex: string): Uint8Array;
+    serialize(): SerializedIdentity;
+    get publicKey(): Uint8Array;
+    get publicKeyHex(): string;
+    get privateKey(): Uint8Array;
+    get privateKeyHex(): string;
+    get fingerprint(): string;
+    toJSON(): {
+        publicKey: string;
+        fingerprint: string;
+    };
+}
+
+interface EncryptedMessage {
+    nonce: string;
+    ciphertext: string;
+}
+interface PublicKeyEncryptedMessage {
+    ephemeralPublicKey: string;
+    nonce: string;
+    ciphertext: string;
+}
+declare class MessageEncryption {
+    private key;
+    constructor(sharedSecret: Uint8Array);
+    encrypt(plaintext: string | Uint8Array): EncryptedMessage;
+    decrypt(encrypted: EncryptedMessage): Uint8Array;
+    decryptToString(encrypted: EncryptedMessage): string;
+    decryptToObject<T = unknown>(encrypted: EncryptedMessage): T;
+    encryptObject(obj: unknown): EncryptedMessage;
+    static fromSharedSecret(sharedSecret: Uint8Array): MessageEncryption;
+}
+declare class PublicKeyEncryption {
+    static encrypt(message: Uint8Array, recipientPublicKey: Uint8Array): PublicKeyEncryptedMessage;
+    static encryptString(message: string, recipientPublicKey: Uint8Array): PublicKeyEncryptedMessage;
+    static encryptStringHex(message: string, recipientPublicKeyHex: string): PublicKeyEncryptedMessage;
+    static decrypt(encrypted: PublicKeyEncryptedMessage, recipientPrivateKey: Uint8Array): Uint8Array;
+    static decryptToString(encrypted: PublicKeyEncryptedMessage, recipientPrivateKey: Uint8Array): string;
+    static decryptToObject<T = unknown>(encrypted: PublicKeyEncryptedMessage, recipientPrivateKey: Uint8Array): T;
+}
+declare function generateNonce(): string;
+declare function generateMessageId(): string;
+
+interface SignedData<T> {
+    data: T;
+    signature: string;
+    senderFingerprint: string;
+    senderPublicKey: string;
+    timestamp: string;
+    nonce: string;
+}
+interface SignatureVerificationResult {
+    valid: boolean;
+    fingerprint?: string;
+    error?: string;
+}
+declare function signData<T>(data: T, identity: PeerIdentity): Promise<SignedData<T>>;
+declare function verifySignedData<T>(signed: SignedData<T>, trustedPublicKey?: Uint8Array): Promise<SignatureVerificationResult>;
+declare function isSignedDataExpired(signed: SignedData<unknown>, maxAgeMs?: number): boolean;
+declare function extractSignerFingerprint(signed: SignedData<unknown>): string | null;
+
+interface KeystoreConfig {
+    path?: string;
+    encryptionKey?: string;
+    useMachineKey?: boolean;
+}
+interface TrustedPeer {
+    fingerprint: string;
+    publicKey: string;
+    name?: string;
+    addedAt: string;
+}
+interface KeystoreData {
+    version: '1.0';
+    trustedPeers: TrustedPeer[];
+    revokedFingerprints: string[];
+}
+declare class SecureKeystore {
+    private path;
+    private passphrase;
+    private identity;
+    private keystoreData;
+    constructor(config?: KeystoreConfig);
+    private get keypairPath();
+    private get keystoreDataPath();
+    ensureDirectory(): Promise<void>;
+    loadOrCreateIdentity(): Promise<PeerIdentity>;
+    saveIdentity(): Promise<void>;
+    getIdentity(): Promise<PeerIdentity | null>;
+    hasIdentity(): Promise<boolean>;
+    deleteIdentity(): Promise<void>;
+    private loadKeystoreData;
+    private saveKeystoreData;
+    addTrustedPeer(fingerprint: string, publicKey: string, name?: string): Promise<void>;
+    removeTrustedPeer(fingerprint: string): Promise<void>;
+    revokePeer(fingerprint: string): Promise<void>;
+    isRevoked(fingerprint: string): Promise<boolean>;
+    isTrusted(fingerprint: string): Promise<boolean>;
+    getTrustedPeer(fingerprint: string): Promise<TrustedPeer | null>;
+    getTrustedPeers(): Promise<TrustedPeer[]>;
+    getRevokedFingerprints(): Promise<string[]>;
+    clearRevokedPeers(): Promise<void>;
+    exportPublicInfo(): Promise<{
+        fingerprint: string;
+        publicKey: string;
+    }>;
+}
+declare function getKeystore(config?: KeystoreConfig): SecureKeystore;
+declare function resetKeystore(): void;
+
+interface EncryptedFile {
+    version: '2.0';
+    encrypted: true;
+    algorithm: 'aes-256-gcm';
+    kdf: 'scrypt';
+    salt: string;
+    iv: string;
+    ciphertext: string;
+    authTag: string;
+}
+declare function deriveKey(passphrase: string, salt: Uint8Array): Promise<Buffer>;
+declare function generateSalt(): Uint8Array;
+declare function generateIV(): Uint8Array;
+declare function encryptData(data: Uint8Array | string, passphrase: string): Promise<EncryptedFile>;
+declare function decryptData(encrypted: EncryptedFile, passphrase: string): Promise<Buffer>;
+declare function encryptObject(obj: unknown, passphrase: string): Promise<EncryptedFile>;
+declare function decryptObject<T = unknown>(encrypted: EncryptedFile, passphrase: string): Promise<T>;
+declare function encryptFile(data: unknown, passphrase: string, outputPath: string): Promise<void>;
+declare function decryptFile<T = unknown>(inputPath: string, passphrase: string): Promise<T>;
+declare function isEncryptedFile(data: unknown): data is EncryptedFile;
+declare function hashPassphrase(passphrase: string): string;
+declare function generateMachineKey(): string;
+
+type DiscoverySecurityMode = 'open' | 'signed' | 'trusted-only';
+type TransportEncryption = 'none' | 'optional' | 'required';
+type TLSMode = 'none' | 'self-signed' | 'ca-signed';
+interface DiscoverySecurityConfig {
+    mode: DiscoverySecurityMode;
+}
+interface TransportSecurityConfig {
+    encryption: TransportEncryption;
+    tls: TLSMode;
+    requireAuth: boolean;
+}
+interface TrustConfig {
+    autoTrustFirst: boolean;
+    requireManualApproval: boolean;
+    trustedFingerprints?: string[];
+}
+interface MeshSecurityConfig {
+    identityPath?: string;
+    discovery: DiscoverySecurityConfig;
+    transport: TransportSecurityConfig;
+    trust: TrustConfig;
+}
+declare const SECURITY_PRESETS: {
+    readonly development: {
+        readonly discovery: {
+            readonly mode: "open";
+        };
+        readonly transport: {
+            readonly encryption: "none";
+            readonly tls: "none";
+            readonly requireAuth: false;
+        };
+        readonly trust: {
+            readonly autoTrustFirst: true;
+            readonly requireManualApproval: false;
+        };
+    };
+    readonly signed: {
+        readonly discovery: {
+            readonly mode: "signed";
+        };
+        readonly transport: {
+            readonly encryption: "optional";
+            readonly tls: "none";
+            readonly requireAuth: false;
+        };
+        readonly trust: {
+            readonly autoTrustFirst: true;
+            readonly requireManualApproval: false;
+        };
+    };
+    readonly secure: {
+        readonly discovery: {
+            readonly mode: "signed";
+        };
+        readonly transport: {
+            readonly encryption: "required";
+            readonly tls: "self-signed";
+            readonly requireAuth: true;
+        };
+        readonly trust: {
+            readonly autoTrustFirst: true;
+            readonly requireManualApproval: false;
+        };
+    };
+    readonly strict: {
+        readonly discovery: {
+            readonly mode: "trusted-only";
+        };
+        readonly transport: {
+            readonly encryption: "required";
+            readonly tls: "self-signed";
+            readonly requireAuth: true;
+        };
+        readonly trust: {
+            readonly autoTrustFirst: false;
+            readonly requireManualApproval: true;
+        };
+    };
+};
+type SecurityPreset = keyof typeof SECURITY_PRESETS;
+declare const DEFAULT_SECURITY_CONFIG: MeshSecurityConfig;
+declare function getSecurityPreset(preset: SecurityPreset): MeshSecurityConfig;
+declare function mergeSecurityConfig(base: MeshSecurityConfig, overrides: Partial<MeshSecurityConfig>): MeshSecurityConfig;
+declare function validateSecurityConfig(config: MeshSecurityConfig): string[];
+declare function isSecurityEnabled(config: MeshSecurityConfig): boolean;
+declare function describeSecurityLevel(config: MeshSecurityConfig): string;
+
+interface AuthToken {
+    hostId: string;
+    fingerprint: string;
+    publicKey: string;
+    capabilities: string[];
+    iat: number;
+    exp: number;
+}
+interface AuthChallengeRequest {
+    challenge: string;
+    timestamp: string;
+}
+interface AuthChallengeResponse {
+    challenge: string;
+    signature: string;
+    publicKey: string;
+    fingerprint: string;
+    timestamp: string;
+}
+interface AuthResult {
+    authenticated: boolean;
+    fingerprint?: string;
+    publicKey?: string;
+    error?: string;
+}
+declare class AuthManager {
+    private identity;
+    private pendingChallenges;
+    constructor(identity: PeerIdentity);
+    private getSigningKey;
+    private getVerifyingKey;
+    createToken(hostId: string, capabilities?: string[], ttlSeconds?: number): Promise<string>;
+    verifyToken(token: string): Promise<AuthToken | null>;
+    createChallenge(): AuthChallengeRequest;
+    respondToChallenge(challengeRequest: AuthChallengeRequest): Promise<AuthChallengeResponse>;
+    verifyChallengeResponse(response: AuthChallengeResponse): Promise<AuthResult>;
+    private cleanupExpiredChallenges;
+    createSignedMessage(payload: unknown): Promise<{
+        payload: unknown;
+        signature: string;
+        fingerprint: string;
+        timestamp: string;
+    }>;
+    verifySignedMessage(message: {
+        payload: unknown;
+        signature: string;
+        fingerprint: string;
+        timestamp: string;
+        publicKey?: string;
+    }): Promise<{
+        valid: boolean;
+        fingerprint?: string;
+        error?: string;
+    }>;
+    get fingerprint(): string;
+    get publicKey(): string;
+}
+declare function extractBearerToken(authHeader: string | undefined): string | null;
+declare function createBearerHeader(token: string): string;
+
+interface TLSContextOptions {
+    cert?: string;
+    key?: string;
+    ca?: string[];
+    requestCert?: boolean;
+    rejectUnauthorized?: boolean;
+}
+interface CertificateInfo {
+    cert: string;
+    key: string;
+    fingerprint: string;
+    notBefore: Date;
+    notAfter: Date;
+    subject: string;
+}
+interface TLSConfig {
+    certPath?: string;
+    keyPath?: string;
+    caPath?: string;
+    rejectUnauthorized?: boolean;
+}
+declare class TLSManager {
+    private certPath;
+    constructor(certPath?: string);
+    ensureDirectory(): Promise<void>;
+    generateCertificate(hostId: string, hostName?: string, validDays?: number): Promise<CertificateInfo>;
+    loadCertificate(hostId: string): Promise<CertificateInfo | null>;
+    loadOrCreateCertificate(hostId: string, hostName?: string): Promise<CertificateInfo>;
+    hasCertificate(hostId: string): Promise<boolean>;
+    getCertificatePath(hostId: string): {
+        certPath: string;
+        keyPath: string;
+    };
+    createServerContext(certInfo: CertificateInfo, options?: {
+        requestClientCert?: boolean;
+        trustedCAs?: string[];
+    }): TLSContextOptions;
+    createClientContext(certInfo?: CertificateInfo, options?: {
+        serverFingerprint?: string;
+        trustedCAs?: string[];
+    }): TLSContextOptions;
+    static computeCertFingerprint(cert: string): string;
+    static verifyCertFingerprint(cert: string, expectedFingerprint: string): boolean;
+}
+declare function getTLSManager(certPath?: string): TLSManager;
+declare function resetTLSManager(): void;
+
+type HostStatus = 'online' | 'offline' | 'unknown';
+interface Host {
+    id: string;
+    name: string;
+    address: string;
+    port: number;
+    tailscaleIP?: string;
+    status: HostStatus;
+    lastSeen: string;
+    version?: string;
+    metadata?: Record<string, unknown>;
+}
+interface Peer {
+    hostId: string;
+    agentId: string;
+    agentName: string;
+    aliases: string[];
+    capabilities: string[];
+    status: HostStatus;
+    lastSeen: string;
+}
+interface PeerMesh {
+    localHost: Host;
+    peers: Map<string, Peer>;
+    hosts: Map<string, Host>;
+}
+interface HostConfig {
+    id: string;
+    name: string;
+    port: number;
+    tailscaleIP?: string;
+    autoStart?: boolean;
+    discoveryEnabled?: boolean;
+    discoveryPort?: number;
+}
+interface HostsFile {
+    version: string;
+    localHost: HostConfig;
+    knownHosts: Host[];
+    lastUpdated: string;
+}
+interface DiscoveryMessage {
+    type: 'announce' | 'query' | 'response';
+    hostId: string;
+    hostName: string;
+    address: string;
+    port: number;
+    tailscaleIP?: string;
+    version: string;
+    timestamp: string;
+}
+interface SignedDiscoveryMessage extends DiscoveryMessage {
+    signature: string;
+    publicKey: string;
+    fingerprint: string;
+}
+interface HealthCheckResult {
+    hostId: string;
+    address: string;
+    port: number;
+    status: HostStatus;
+    latencyMs: number;
+    error?: string;
+    checkedAt: string;
+}
+interface PeerRegistration {
+    hostId: string;
+    agentId: string;
+    agentName: string;
+    aliases: string[];
+    capabilities: string[];
+}
+interface TransportMessage {
+    id: string;
+    type: string;
+    from: string;
+    to: string;
+    payload: unknown;
+    timestamp: string;
+}
+interface SecureTransportMessage extends TransportMessage {
+    signature: string;
+    senderFingerprint: string;
+    senderPublicKey: string;
+    nonce: string;
+    encrypted?: boolean;
+}
+interface EncryptedTransportMessage {
+    id: string;
+    senderFingerprint: string;
+    nonce: string;
+    ciphertext: string;
+    timestamp: string;
+}
+interface TransportOptions {
+    timeout?: number;
+    retries?: number;
+    retryDelay?: number;
+}
+interface SecureTransportOptions extends TransportOptions {
+    requireEncryption?: boolean;
+    requireAuth?: boolean;
+    authToken?: string;
+}
+declare const DEFAULT_PORT = 9876;
+declare const DEFAULT_DISCOVERY_PORT = 9877;
+declare const HEALTH_CHECK_TIMEOUT = 5000;
+declare const DISCOVERY_INTERVAL = 30000;
+declare const MESH_VERSION = "1.7.11";
+
+declare function getHostsFilePath(): Promise<string>;
+declare function loadHostsFile(): Promise<HostsFile>;
+declare function saveHostsFile(hostsFile: HostsFile): Promise<void>;
+declare function createDefaultHostsFile(): HostsFile;
+declare function getLocalHostConfig(): Promise<HostConfig>;
+declare function updateLocalHostConfig(updates: Partial<HostConfig>): Promise<HostConfig>;
+declare function addKnownHost(host: Host): Promise<void>;
+declare function removeKnownHost(hostId: string): Promise<boolean>;
+declare function getKnownHosts(): Promise<Host[]>;
+declare function getKnownHost(hostId: string): Promise<Host | undefined>;
+declare function updateKnownHost(hostId: string, updates: Partial<Host>): Promise<Host | null>;
+declare function initializeHostsFile(): Promise<HostsFile>;
+
+interface LocalDiscoveryOptions {
+    port?: number;
+    interval?: number;
+    onDiscover?: (host: Host) => void;
+}
+declare class LocalDiscovery {
+    private socket;
+    private announceInterval;
+    private running;
+    private options;
+    private discoveredHosts;
+    constructor(options?: LocalDiscoveryOptions);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    announce(): Promise<void>;
+    query(): Promise<void>;
+    getDiscoveredHosts(): Host[];
+    isRunning(): boolean;
+    private handleMessage;
+}
+declare function getLocalIPAddress(): string;
+declare function getAllLocalIPAddresses(): string[];
+declare function discoverOnce(timeout?: number): Promise<Host[]>;
+
+interface SecureLocalDiscoveryOptions {
+    port?: number;
+    interval?: number;
+    onDiscover?: (host: Host, fingerprint?: string) => void;
+    security?: MeshSecurityConfig;
+    identity?: PeerIdentity;
+    keystore?: SecureKeystore;
+}
+declare class SecureLocalDiscovery {
+    private socket;
+    private announceInterval;
+    private running;
+    private options;
+    private discoveredHosts;
+    private identity;
+    private keystore;
+    private securityMode;
+    constructor(options?: SecureLocalDiscoveryOptions);
+    initialize(): Promise<void>;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    announce(): Promise<void>;
+    query(): Promise<void>;
+    getDiscoveredHosts(): Host[];
+    isRunning(): boolean;
+    getFingerprint(): string | null;
+    private handleMessage;
+    private isSignedMessage;
+    private verifySignedMessage;
+}
+declare function discoverOnceSecure(timeout?: number, options?: SecureLocalDiscoveryOptions): Promise<Host[]>;
+
+interface TailscaleStatus {
+    available: boolean;
+    self?: TailscalePeer;
+    peers: TailscalePeer[];
+    magicDNSSuffix?: string;
+}
+interface TailscalePeer {
+    id: string;
+    name: string;
+    tailscaleIP: string;
+    hostname: string;
+    online: boolean;
+    os?: string;
+    lastSeen?: string;
+}
+declare function getTailscaleStatus(): Promise<TailscaleStatus>;
+declare function isTailscaleAvailable(): Promise<boolean>;
+declare function getTailscaleIP(): Promise<string | null>;
+declare function discoverTailscaleHosts(skillkitPort: number): Promise<Host[]>;
+declare function resolveTailscaleName(hostname: string): Promise<string | null>;
+
+interface PeerRegistry {
+    peers: Map<string, Peer>;
+    localPeers: Map<string, Peer>;
+}
+declare class PeerRegistryManager {
+    private registry;
+    initialize(): Promise<void>;
+    registerLocalPeer(registration: PeerRegistration): Promise<Peer>;
+    unregisterLocalPeer(agentId: string): Promise<boolean>;
+    registerRemotePeer(peer: Peer): void;
+    unregisterRemotePeer(hostId: string, agentId: string): boolean;
+    getPeer(hostId: string, agentId: string): Peer | undefined;
+    getLocalPeer(agentId: string): Peer | undefined;
+    getAllPeers(): Peer[];
+    getLocalPeers(): Peer[];
+    getRemotePeers(): Peer[];
+    getPeersByHost(hostId: string): Peer[];
+    findPeerByName(name: string): Peer | undefined;
+    findPeersByCapability(capability: string): Peer[];
+    resolvePeerAddress(nameOrId: string): Promise<{
+        host: Host;
+        peer: Peer;
+    } | null>;
+    updatePeerStatus(hostId: string, agentId: string, status: Peer['status']): void;
+    markHostOffline(hostId: string): void;
+    markHostOnline(hostId: string): void;
+    clearRemotePeers(): void;
+    private loadLocalPeers;
+    private saveLocalPeers;
+}
+declare function getPeerRegistry(): Promise<PeerRegistryManager>;
+
+interface HealthCheckOptions {
+    timeout?: number;
+    updateStatus?: boolean;
+}
+declare function checkHostHealth(host: Host, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+declare function checkAllHostsHealth(options?: HealthCheckOptions): Promise<HealthCheckResult[]>;
+declare function getOnlineHosts(): Promise<Host[]>;
+declare function getOfflineHosts(): Promise<Host[]>;
+declare function waitForHost(host: Host, maxWaitMs?: number, intervalMs?: number): Promise<boolean>;
+declare class HealthMonitor {
+    private interval;
+    private running;
+    private checking;
+    private onStatusChange?;
+    constructor(options?: {
+        onStatusChange?: (host: Host, oldStatus: HostStatus, newStatus: HostStatus) => void;
+    });
+    start(intervalMs?: number): Promise<void>;
+    stop(): void;
+    isRunning(): boolean;
+    private checkAll;
+}
+
+interface HttpTransportOptions extends TransportOptions {
+    baseUrl?: string;
+    headers?: Record<string, string>;
+}
+declare class HttpTransport {
+    private client;
+    private options;
+    constructor(host: Host, options?: HttpTransportOptions);
+    send(path: string, payload: unknown): Promise<TransportMessage>;
+    sendMessage(to: string, type: string, payload: unknown): Promise<TransportMessage>;
+    registerPeer(registration: unknown): Promise<TransportMessage>;
+    getPeers(): Promise<TransportMessage>;
+    healthCheck(): Promise<boolean>;
+}
+declare function sendToHost(host: Host, path: string, payload: unknown, options?: HttpTransportOptions): Promise<TransportMessage>;
+declare function broadcastToHosts(hosts: Host[], path: string, payload: unknown, options?: HttpTransportOptions): Promise<Map<string, TransportMessage | Error>>;
+
+interface WebSocketTransportOptions extends TransportOptions {
+    reconnect?: boolean;
+    reconnectInterval?: number;
+    maxReconnectAttempts?: number;
+}
+type MessageHandler = (message: TransportMessage, socket: WebSocket) => void;
+declare class WebSocketTransport {
+    private socket;
+    private options;
+    private url;
+    private reconnectAttempts;
+    private messageHandlers;
+    private connected;
+    private reconnectTimer;
+    private manualClose;
+    constructor(host: Host, options?: WebSocketTransportOptions);
+    connect(): Promise<void>;
+    disconnect(): void;
+    send(message: Omit<TransportMessage, 'id' | 'timestamp'>): Promise<void>;
+    onMessage(handler: MessageHandler): () => void;
+    isConnected(): boolean;
+    private scheduleReconnect;
+}
+declare class WebSocketServer2 {
+    private server;
+    private clients;
+    private messageHandlers;
+    private port;
+    private running;
+    constructor(port?: number);
+    start(): Promise<void>;
+    stop(): void;
+    broadcast(message: Omit<TransportMessage, 'id' | 'timestamp'>): void;
+    sendTo(socket: WebSocket, message: Omit<TransportMessage, 'id' | 'timestamp'>): void;
+    onMessage(handler: MessageHandler): () => void;
+    getClientCount(): number;
+    isRunning(): boolean;
+}
+
+interface SecureWebSocketOptions {
+    timeout?: number;
+    reconnect?: boolean;
+    reconnectInterval?: number;
+    maxReconnectAttempts?: number;
+    security?: MeshSecurityConfig;
+    identity?: PeerIdentity;
+    keystore?: SecureKeystore;
+}
+type SecureMessageHandler = (message: TransportMessage, socket: WebSocket, senderFingerprint?: string) => void;
+declare class SecureWebSocketTransport {
+    private socket;
+    private host;
+    private options;
+    private identity;
+    private keystore;
+    private authManager;
+    private encryption;
+    private reconnectAttempts;
+    private messageHandlers;
+    private connected;
+    private authenticated;
+    private reconnectTimer;
+    constructor(host: Host, options?: SecureWebSocketOptions);
+    initialize(): Promise<void>;
+    private getUrl;
+    connect(): Promise<void>;
+    private performClientHandshake;
+    disconnect(): void;
+    send(message: Omit<TransportMessage, 'id' | 'timestamp'>): Promise<void>;
+    onMessage(handler: SecureMessageHandler): () => void;
+    isConnected(): boolean;
+    isAuthenticated(): boolean;
+    getFingerprint(): string | null;
+    private scheduleReconnect;
+}
+declare class SecureWebSocketServer {
+    private wss;
+    private httpsServer;
+    private clients;
+    private messageHandlers;
+    private port;
+    private running;
+    private identity;
+    private keystore;
+    private authManager;
+    private tlsManager;
+    private certInfo;
+    private security;
+    private hostId;
+    constructor(port?: number, options?: {
+        security?: MeshSecurityConfig;
+        identity?: PeerIdentity;
+        keystore?: SecureKeystore;
+        hostId?: string;
+    });
+    initialize(): Promise<void>;
+    start(): Promise<void>;
+    private handleConnection;
+    private performServerHandshake;
+    stop(): void;
+    broadcast(message: Omit<TransportMessage, 'id' | 'timestamp'>): Promise<void>;
+    sendTo(socket: WebSocket, message: Omit<TransportMessage, 'id' | 'timestamp'>): Promise<void>;
+    onMessage(handler: SecureMessageHandler): () => void;
+    getClientCount(): number;
+    isRunning(): boolean;
+    getFingerprint(): string | null;
+    getAuthenticatedClients(): Array<{
+        fingerprint: string;
+        publicKey: string;
+    }>;
+}
+
+interface SecureHttpTransportOptions {
+    timeout?: number;
+    retries?: number;
+    retryDelay?: number;
+    headers?: Record<string, string>;
+    security?: MeshSecurityConfig;
+    identity?: PeerIdentity;
+    keystore?: SecureKeystore;
+    authToken?: string;
+}
+declare class SecureHttpTransport {
+    private client;
+    private options;
+    private identity;
+    private keystore;
+    private authManager;
+    private authToken;
+    private host;
+    private security;
+    constructor(host: Host, options?: SecureHttpTransportOptions);
+    initialize(): Promise<void>;
+    private getSecureHeaders;
+    send(path: string, payload: unknown): Promise<TransportMessage>;
+    sendMessage(to: string, type: string, payload: unknown): Promise<TransportMessage>;
+    registerPeer(registration: unknown): Promise<TransportMessage>;
+    getPeers(): Promise<TransportMessage>;
+    healthCheck(): Promise<boolean>;
+    getFingerprint(): string | null;
+    setAuthToken(token: string): void;
+}
+declare function sendToHostSecure(host: Host, path: string, payload: unknown, options?: SecureHttpTransportOptions): Promise<TransportMessage>;
+declare function broadcastToHostsSecure(hosts: Host[], path: string, payload: unknown, options?: SecureHttpTransportOptions): Promise<Map<string, TransportMessage | Error>>;
+declare function verifySecureMessage(message: SecureTransportMessage): {
+    valid: boolean;
+    error?: string;
+};
+
+declare function initializeMesh(): Promise<void>;
+declare function initializeSecureMesh(securityConfig?: MeshSecurityConfig): Promise<{
+    identity: PeerIdentity;
+    keystore: SecureKeystore;
+}>;
+
+export { type AuthChallengeRequest, type AuthChallengeResponse, AuthManager, type AuthResult, type AuthToken, type CertificateInfo, DEFAULT_DISCOVERY_PORT, DEFAULT_PORT, DEFAULT_SECURITY_CONFIG, DISCOVERY_INTERVAL, type DiscoveryMessage, type DiscoverySecurityConfig, type DiscoverySecurityMode, type EncryptedFile, type EncryptedMessage, type EncryptedTransportMessage, HEALTH_CHECK_TIMEOUT, type HealthCheckOptions, type HealthCheckResult, HealthMonitor, type Host, type HostConfig, type HostStatus, type HostsFile, HttpTransport, type HttpTransportOptions, type KeystoreConfig, type KeystoreData, LocalDiscovery, type LocalDiscoveryOptions, MESH_VERSION, type MeshSecurityConfig, MessageEncryption, type MessageHandler, type Peer, PeerIdentity, type PeerKeypair, type PeerMesh, type PeerRegistration, type PeerRegistry, PeerRegistryManager, type PublicKeyEncryptedMessage, PublicKeyEncryption, SECURITY_PRESETS, SecureHttpTransport, type SecureHttpTransportOptions, SecureKeystore, SecureLocalDiscovery, type SecureLocalDiscoveryOptions, type SecureMessageHandler, type SecureTransportMessage, type SecureTransportOptions, type SecureWebSocketOptions, SecureWebSocketServer, SecureWebSocketTransport, type SecurityPreset, type SerializedIdentity, type SignatureVerificationResult, type SignedData, type SignedDiscoveryMessage, type TLSConfig, type TLSContextOptions, TLSManager, type TLSMode, type TailscalePeer, type TailscaleStatus, type TransportEncryption, type TransportMessage, type TransportOptions, type TransportSecurityConfig, type TrustConfig, type TrustedPeer, WebSocketServer2 as WebSocketServer, WebSocketTransport, type WebSocketTransportOptions, addKnownHost, broadcastToHosts, broadcastToHostsSecure, checkAllHostsHealth, checkHostHealth, createBearerHeader, createDefaultHostsFile, decryptData, decryptFile, decryptObject, deriveKey, describeSecurityLevel, discoverOnce, discoverOnceSecure, discoverTailscaleHosts, encryptData, encryptFile, encryptObject, extractBearerToken, extractSignerFingerprint, generateIV, generateMachineKey, generateMessageId, generateNonce, generateSalt, getAllLocalIPAddresses, getHostsFilePath, getKeystore, getKnownHost, getKnownHosts, getLocalHostConfig, getLocalIPAddress, getOfflineHosts, getOnlineHosts, getPeerRegistry, getSecurityPreset, getTLSManager, getTailscaleIP, getTailscaleStatus, hashPassphrase, initializeHostsFile, initializeMesh, initializeSecureMesh, isEncryptedFile, isSecurityEnabled, isSignedDataExpired, isTailscaleAvailable, loadHostsFile, mergeSecurityConfig, removeKnownHost, resetKeystore, resetTLSManager, resolveTailscaleName, saveHostsFile, sendToHost, sendToHostSecure, signData, updateKnownHost, updateLocalHostConfig, validateSecurityConfig, verifySecureMessage, verifySignedData, waitForHost };